urgent, pls take a look: HijackThis log

[jkr48625]

hello, i had a spyware programme (spysheriff) uninstalled using TuneUp, disabled everything on start-up via msconfig and ran cwshredder (removed 1 item). random Globe7 web pages would pop up while running firefox. couldnt run spybot & ad-aware probably due to spyware, so here's the log, thanks.


Logfile of HijackThis v1.99.1
Scan saved at 11:43:13 AM, on 16/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\batserv2.exe
C:\WINDOWS\system32\mpcsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\sysc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e
C:\Program Files\Mozilla Firefox\firefox.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
O4 - HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)


O20 - Winlogon Notify: access98 - C:\WINDOWS\SYSTEM32\access98.dll
O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll
O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\e0202afmgd2a2.dll
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\dflgpjig.dll
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

[Budfred]

Did you edit out part of this log?? If so, we need to see the whole thing to know what is going on... In the meanwhile, run Ewido in Safe Mode to see what it can clean up... Run Spybot and Ad-Aware in Safe Mode as well... Update all of them before going into Safe Mode...

Please download, install, and update the NEW free version of Ewido trojan scanner:

1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
   
2. When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
   
3. From the main ewido screen, click on update in the left menu, then click the Start update button.
   
4. After the update finishes (the status bar at the bottom will display "Update successful")
   
5. Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
   
6. Check "Perform action with all infections".
   
7. When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Reboot and post the complete HJT log and the Ewido log... You can leave out the cookie deletions in the Ewido log to shorten it... You have some major problems here...

[jkr48625]

without the cookies
+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083} -> Logger.Agent.io : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup
HKU\S-1-5-21-725345543-1229272821-2147250837-1003\Software\Microsoft\Internet Explorer\Keywords -> Adware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-725345543-1229272821-2147250837-1003\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{06849E9F-C8D7-4D59-B87D-784B7D6BE083} -> Logger.Agent.io : Error during cleaning
HKU\S-1-5-21-725345543-1229272821-2147250837-1003\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{6001CDF7-6F45-471B-A203-0225615E35A7} -> Adware.Generic : Error during cleaning
[1504] C:\WINDOWS\system32\access98.dll -> Logger.Goldun.ib : Cleaned with backup
[380] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Cleaned with backup
[448] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
[1052] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
[1064] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
[2092] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
[2504] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
[972] c:\program files\creative\creative zen microphoto\auto tag cleaner\jisnlk32.dll -> Trojan.Zapchast : Cleaned with backup

[jkr48625]

C:\Documents and Settings\Christopher\Local Settings\Temp\368.tmp -> Trojan.Agent.fs : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\1052.tmp -> Downloader.Agent.afl : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2408.tmp -> Downloader.Small.ckn : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2452.tmp -> Downloader.Small.atl : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2516.tmp -> Downloader.Small.skn : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2540.tmp -> Downloader.Agent.agg : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2700.tmp -> Logger.ProAgent.u : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2788.tmp -> Downloader.Agent.agg : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2800.tmp -> Logger.ProAgent.u : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2812.tmp -> Downloader.Small.ckn : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2840.tmp -> Downloader.CWS.s : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2856.tmp -> Downloader.CWS.s : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2912.tmp -> Trojan.Dialer.ay : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3036.tmp -> Downloader.Tiny.ap : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3048.tmp -> Downloader.Agent.agg : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3076.tmp -> Dropper.Delf.th : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3096.tmp -> Dropper.Delf.th : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3116.tmp -> Downloader.Small.cnr : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3212.tmp -> Logger.ProAgent.u : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3244.tmp -> Logger.ProAgent.u : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3272.tmp -> Downloader.CWS.s : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3352.tmp -> Downloader.CWS.s : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3520.tmp -> Downloader.Small.cnr : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3604.tmp -> Downloader.Small.cnr : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\4040.tmp -> Downloader.Tiny.ap : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\6.qtdfmp -> Downloader.Small.atl : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\7.qtdfmp -> Downloader.Tibs.bu : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\dmx5.tmp -> Worm.Locksky.al : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\dmxE.tmp -> Dropper.Small.ame : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\maxdd.game -> Trojan.Dialer.ay : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\qvxt2.game -> Downloader.Tiny.ap : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\tatus_4bd.exe -> Downloader.Agent.afl : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\tatus_6bd.exe -> Logger.Small.ak : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vx1.game -> Downloader.Agent.agg : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vx2.game -> Logger.ProAgent.u : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vx3.game -> Downloader.CWS.s : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vx6.game -> Downloader.Small.cnr : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vxt1.game -> Downloader.Small.ckn : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vxt2.game -> Downloader.Small.skn : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temp\vxt3.game -> Dropper.Delf.th : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\0B8TOPWX\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : Cleaned with backup

[jkr48625]

C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\0B8TOPWX\tool4[1].txt -> Proxy.Wopla.r : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\52VHPMKY\paytime[1].txt -> Hijacker.StartPage.adi : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\7RD7ZHOW\kl[1].txt -> Logger.Small.dg : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\A2R15Z1Z\din[1] -> Trojan.Agent.fs : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\A2R15Z1Z\mousepad2[1].exe -> Hijacker.VB.li : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\F61CTFJ7\din[1].dll -> Downloader.Agent.afl : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\F61CTFJ7\Installer[1].exe -> Adware.Look2Me : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\I5ZKDGVM\drsmartload[1].exe -> Downloader.Adload.x : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\S9Y1W74R\keyboard2[1].exe -> Downloader.VB.yn : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\S9Y1W74R\l[1].exe -> Downloader.Agent.afl : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\TWSND945\1000mails[1].exe -> Logger.Small.ak : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\TWSND945\toolbar[1].txt -> Downloader.Adload.w : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\WVVRM8DT\tool2[1].txt -> Not-A-Virus.Hoax.Win32.Renos.bw : Cleaned with backup
C:\drsmartload1.exe -> Downloader.Adload.x : Cleaned with backup
C:\Installer.exe -> Adware.Look2Me : Cleaned with backup
C:\keyboard2.exe -> Downloader.VB.yn : Cleaned with backup
C:\ld.exe -> Downloader.Small.cke : Cleaned with backup
C:\ld.exe.bak -> Downloader.Small.cke : Cleaned with backup
C:\mousepad2.exe -> Hijacker.VB.li : Cleaned with backup
C:\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup
C:\Program Files\Adobe\Photoshop 6.0\rwxqm4.dll -> Trojan.Small : Cleaned with backup
C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Int el32\whvspr32.dll -> Trojan.Small : Cleaned with backup
C:\Program Files\Creative\Creative Zen MicroPhoto\Auto Tag Cleaner\jisnlk32.dll -> Trojan.Zapchast : Cleaned with backup
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup
C:\Program Files\SpySheriff -> Adware.SpySheriff : Cleaned with backup
C:\Program Files\SpySheriff\Uninstall.exe -> Adware.SpySheriff : Cleaned with backup
C:\WINDOWS\avalon_4.txt -> Trojan.Agent.fs : Cleaned with backup
C:\WINDOWS\DH.dll -> Hijacker.Small.jf : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1015.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\WUInst.dll -> Adware.SaveNow : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\WUInst.dll -> Adware.SaveNow : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\WUInst.dll -> Adware.SaveNow : Cleaned with backup
C:\WINDOWS\inet20004\3.02.00.dll -> Adware.Ihbo : Cleaned with backup
C:\WINDOWS\inet20004\alg.exe -> Worm.Delf.i : Cleaned with backup
C:\WINDOWS\inet20004\alg.exe.bak -> Worm.Delf.i : Cleaned with backup
C:\WINDOWS\inet20004\mm5.exe -> Logger.Delf.ig : Cleaned with backup
C:\WINDOWS\inet20004\mm6.exe -> Logger.Delf.ig : Cleaned with backup
C:\WINDOWS\inet20004\mm6.exe.bak -> Logger.Delf.ig : Cleaned with backup
C:\WINDOWS\inet20004\services.exe -> Downloader.CWS.s : Cleaned with backup
C:\WINDOWS\kl1.exe -> Logger.Small.dg : Cleaned with backup
C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Cleaned with backup
C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe -> Adware.CommAd : Cleaned with backup
C:\WINDOWS\sachostx.exe -> Worm.Locksky.al : Cleaned with backup
C:\WINDOWS\sysldr32.exe -> Downloader.Agent.agg : Cleaned with backup
C:\WINDOWS\system32\70tovmto.ini -> Adware.Sahat : Cleaned with backup
C:\WINDOWS\system32\cddhmpbn.exe -> Proxy.Wopla.r : Cleaned with backup
C:\WINDOWS\system32\dajoamki.exe -> Proxy.Wopla.r : Cleaned with backup
C:\WINDOWS\system32\dflgpjig.dll -> Proxy.Wopla.s : Cleaned with backup
C:\WINDOWS\system32\intell321.exe -> Trojan.Small.ev : Cleaned with backup
C:\WINDOWS\system32\maxd64.exe -> Trojan.Dialer.ay : Cleaned with backup
C:\WINDOWS\system32\mspostsp.exe -> Trojan.Inject.i : Cleaned with backup
C:\WINDOWS\system32\msupdate32.dll -> Downloader.Delf.aic : Cleaned with backup
C:\WINDOWS\system32\msvcrl.dll -> Worm.Locksky.al : Cleaned with backup
C:\WINDOWS\system32\nvwks.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\o4840elqehqe0.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\oleext.dll -> Trojan.Small.ev : Cleaned with backup
C:\WINDOWS\system32\paytime.exe -> Hijacker.StartPage.adi : Cleaned with backup
C:\WINDOWS\system32\pqh.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\qvxgamet2.exe -> Downloader.Tiny.ap : Cleaned with backup
C:\WINDOWS\system32\qvxgamet4.exe -> Downloader.Agent.afl : Cleaned with backup
C:\WINDOWS\system32\sachostp.exe -> Worm.Locksky.al : Cleaned with backup
C:\WINDOWS\system32\sachosts.exe -> Worm.Locksky.al : Cleaned with backup
C:\WINDOWS\system32\sndmixex.dll -> Downloader.Agent.afl : Cleaned with backup
C:\WINDOWS\system32\vxgame1.exe -> Downloader.Agent.agg : Cleaned with backup
C:\WINDOWS\system32\vxgame3.exe -> Downloader.CWS.s : Cleaned with backup
C:\WINDOWS\system32\vxgame6.exe -> Downloader.Small.cnr : Cleaned with backup
C:\WINDOWS\system32\vxgamet1.exe -> Downloader.Small.ckn : Cleaned with backup
C:\WINDOWS\system32\vxgamet2.exe -> Downloader.Small.skn : Cleaned with backup
C:\WINDOWS\system32\vxgamet3.exe -> Dropper.Delf.th : Cleaned with backup
C:\WINDOWS\system32\vxh8jkdq6.exe -> Downloader.Small.atl : Cleaned with backup
C:\WINDOWS\system32\vxh8jkdq7.exe -> Downloader.Tibs.bu : Cleaned with backup
C:\WINDOWS\system32\Xcite.exe -> Adware.F1Organizer : Cleaned with backup
C:\WINDOWS\system32\zdib.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\sysvx_.exe -> Downloader.Small.cnr : Cleaned with backup
C:\WINDOWS\tool2.exe -> Not-A-Virus.Hoax.Win32.Renos.bw : Cleaned with backup
C:\WINDOWS\toolbar.exe -> Downloader.Adload.w : Cleaned with backup
C:\WINDOWS\uninstDsk.exe -> Trojan.Small.ev : Cleaned with backup
C:\winstall.exe -> Not-A-Virus.Hoax.Win32.Renos.bw : Cleaned with backup


::Report End

[jkr48625]

Logfile of HijackThis v1.99.1
Scan saved at 12:56:02 PM, on 16/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\batserv2.exe
C:\WINDOWS\system32\mpcsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\sysc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
O4 - HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)


O20 - Winlogon Notify: access98 - access98.dll (file missing)
O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)
O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\e0202afmgd2a2.dll
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\dflgpjig.dll (file missing)
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

[jkr48625]

i cant get spybot to load, as for ad aware, it just hangs at C://windows/system32/netrap.dll

i didnt modify the first hijack log, i added blank lines for easy reading

[hockey man]

Is that an un-altered log? Budfred needs to see the whole thing to correctly analyse it.

[jkr48625]

i'm still having random webpages popping up though

e.g. hxxp://www.uniqueoffer-s.com/normal/yyy102.html

[jkr48625]

i ran ad-aware smart search and there were over 80 objects. should i remove them or wait for your analysis

[beerbelly]

Don't do anything untill Budfred or Classic software tells you to! Be patient, you'll get all the help you need.

[jkr48625]

i'm so tempted to remove whatever ad-aware caught... tired of popping web pages

[jkr48625]

after running Ewido, ad-aware & spybot are running fine

[Budfred]

Please do not post active malware links and please do not put the spaces in the log for easy reading, it makes them harder to read.... I edited your malware link to disable it... It would have been a good idea to fix whatever Ad-Aware found and I was indicating you should do so when I asked you to run it again... Go ahead and run it before these HJT fixes... If you don't find any of these things, it is hopefully because Ad-Aware took care of them already:

Open and HJT scan and put checks by:

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe
O20 - Winlogon Notify: access98 - access98.dll (file missing)
O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)
O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\e0202afmgd2a2.dll
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\dflgpjig.dll (file missing)
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

I couldn't find reliable information on this one... Unless you recognize the program, I suggest you fix it too:

O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe

Close all open windows except HJT and press Fix checked...

Enter each of the following one at a time into the command prompt (Start > Run > type cmd):

sc delete cmdService
sc delete Network Monitor

Find and delete:

C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe
C:\WINDOWS\batserv2.exe
C:\WINDOWS\system32\kernels8.exe
C:\WINDOWS\system32\e0202afmgd2a2.dll
c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
C:\WINDOWS\system32\dflgpjig.dll
C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (folder)
C:\Program Files\Network Monitor\netmon.exe (folder)
C:\WINDOWS\system32\mpcsvc.exe
C:\WINDOWS\system32\sysc.exe

Use Windows Search to find and delete:

access98.dll
msupdate32.dll

The item with all the ~~ in it is abbreviated, so you will need to look for folders that start with the letters noted... It is likely that the whole folder that begins with "profes" is what needs to be deleted, but I can't be sure based on the info here... Check what is in the folder and post back if you are not sure what to do...

Once you complete all of these steps, run Ewido, Spybot and Ad-Aware again, letting them fix whatever they find...

Reboot and post a fresh HJT log and the Ewido log...

[jkr48625]

Find and delete:

C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe
C:\WINDOWS\batserv2.exe
C:\WINDOWS\system32\kernels8.exe
C:\WINDOWS\system32\e0202afmgd2a2.dll
c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
C:\WINDOWS\system32\dflgpjig.dll
C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (folder)
C:\Program Files\Network Monitor\netmon.exe (folder)
C:\WINDOWS\system32\mpcsvc.exe
C:\WINDOWS\system32\sysc.exe

Use Windows Search to find and delete:

access98.dll
msupdate32.dll

should i delete these files as well?:

ibm00003.dll
IBM00003.EXE-184AC576.pf
_IBM00003.EXE-08FDF596.pf
MPCSVC.EXE-126E1191.pf
SYSC.EXE-1EE5211B.pf


ran ad-aware and found but i cant delete:
j2j60c1sef.dll
reason given: used by another person or program

after running spybot, adaware, cwshredder, latest hijack log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
O4 - HKLM\..\RunServices: [BootLocker0] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker1] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker2] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker3] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker4] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker5] C:\Program Files\BootLocker\Msgsvr32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\j2j60c1sef.dll
O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - (no file)
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

i still have random web pages popping up, and when after start-up a dialog box says: an exception occured while trying to run"

c:\\windows\system32\ejfpixaudio.dll", DIIGetVersion"

[jkr48625]

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 11:53:41 PM, 16/03/2006
+ Report-Checksum: B8B8D964

+ Scan result:

[300] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\osb8lshi.jonathan\co okies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\osb8lshi.jonathan\co okies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\osb8lshi.jonathan\co okies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\WVVRM8DT\1[1].exe -> Downloader.Small.ckt : Cleaned with backup
C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\__delete_on_reboot__sbcur32.dl l -> Adware.Look2Me : Cleaned with backup


::Report End

BootLocker is a program to password-protect the pc. i re-installed it and now it doesnt work.

[Budfred]

Where did you see these??

ibm00003.dll
IBM00003.EXE-184AC576.pf
_IBM00003.EXE-08FDF596.pf
MPCSVC.EXE-126E1191.pf
SYSC.EXE-1EE5211B.pf

It looks like most of them were in Prefetch... You can certainly delete them if they are still there....

Do this to see if we got rid of the worst infection:

Download haxfix.exe.
Save it to your desktop.
Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark "Create a desktop icon".
Click "Next".
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed.
Click "Finish".
A red "dos window" (dos box) will open.
Select option 1. Make logfile by typing 1 and then pressing Enter.
Haxfix will start scanning the computer. When it is finished a logfile will open.
Copy the contents of that logfile and paste it into this thread.

Where did you get BootLocker and why do you need it... These look like they are bad and that suggests this could be a rogue:

O4 - HKLM\..\RunServices: [BootLocker0] C:\Program Files\BootLocker\Msgsvr32.exe

Unless you are certain that this program can be trusted, I suggest uninstalling the program and fixing these with HJT:

O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
O4 - HKLM\..\RunServices: [BootLocker0] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker1] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker2] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker3] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker4] C:\Program Files\BootLocker\Msgsvr32.exe
O4 - HKLM\..\RunServices: [BootLocker5] C:\Program Files\BootLocker\Msgsvr32.exe

And fix these regardless:

O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\j2j60c1sef.dll
O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - (no file)
O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)

Then:

Open HJT, go to Config and then to Misc Tools and use the "delete on reboot" option to enter the whole location and file for each of these one at a time... Click through to close HJT and reboot... Please note if you are still having any problems when you post back....

C:\WINDOWS\system32\j2j60c1sef.dll
c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll

Then reboot and post the HaxFix log and a fresh HJT log...

[jkr48625]

HijackThis:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\dn2u01f9e.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe


HAXFIX logfile - by Marckie
--------------
Fri 17/03/2006 10:54:14.53

checking for ps.a3d....
ps.a3d not found

checking for matching notify keys....
no matching notify keys found

checking for matching services....
matching services found
Aspi32

checking for matching safeboot services....
no matching safeboot services found

----------
- now this pops on start up
an exception occured while trying to run"c:\\windows\system32\mcorc32r.dll", DIIGetVersion"

- random web pages still pops up on firefox

- should i re-reun cwsshredder, ewidos, ad-aware & spybot?

[Budfred]

You need to run another tool now:

Please download Look2Me-Remover.exe to your desktop.

• Close all windows before continuing.
• Double-click Look2Me-Remover.exe to run it.
• Put a check next to Run this program as a task.
• You will receive a message saying Look2Me-Remover will close and re-open in approximately 10 seconds. Click OK
• When Look2Me-Remover re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
• Once it's done scanning, click the Remove L2M button.
• You will receive a Done Scanning message, click OK.
• When completed, you will receive this message: Done removing infected files! Look2Me-Remover will now shutdown your computer, click OK.
• Your computer will then shutdown.
• Turn your computer back on.
• Please post the contents of C:\Look2Me-Remover.txt and a new HiJackThis log.

If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
http://www.ascentive.com/support/new...b/MSWINSCK.OCX

Then use HJT to fix:

O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\dn2u01f9e.dll

Post the fresh HJT log and L2M log after reboot...

[jkr48625]

Look2Me-Destroyer V1.0.11

Scanning for infected files.....
Scan started at 3/17/2006 11:58:02 AM

Infected! C:\WINDOWS\system32\dn2u01f9e.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276120.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276124.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276140.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276148.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276150.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276155.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276198.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276201.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276216.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276233.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276237.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276272.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276279.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276287.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276336.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276343.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276348.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276353.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276359.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276418.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276435.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276441.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276442.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276443.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276444.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276445.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276460.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276467.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276469.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276476.dll
Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276531.dll
Infected! C:\WINDOWS\system32\guard.tmp

[jkr48625]

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\dn2u01f9e.dll
C:\WINDOWS\system32\dn2u01f9e.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276120.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276120.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276124.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276124.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276140.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276140.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276148.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276148.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276150.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276150.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276155.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276155.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276198.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276198.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276201.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276201.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276216.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276216.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276233.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276233.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276237.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276237.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276272.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276272.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276279.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276279.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276287.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276287.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276336.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276336.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276343.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276343.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276348.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276348.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276353.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276353.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276359.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276359.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276418.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276418.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276435.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276435.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276441.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276441.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276442.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276442.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276443.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276443.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276444.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276444.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276445.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276445.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276460.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276460.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276467.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276467.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276469.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276469.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276476.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276476.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276531.dll
C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276531.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp could not be deleted!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{59C2E740-FD25-4C53-93C0-6C9953210A97}"
HKCR\Clsid\{59C2E740-FD25-4C53-93C0-6C9953210A97}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrators - Succeeded

[jkr48625]

Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

------------------------

Then use HJT to fix:

O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\dn2u01f9e.dll

hijackthis didnt show this but it did show up under window search

[Budfred]

It looks like L2M is still there... Try running Look2Me-Remover in Safe Mode and see if that will kill it... If it doesn't, run this:

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[jkr48625]

Try running Look2Me-Remover in Safe Mode and see if that will kill it...

that didnt work, Look2Me-Remover's Scan for L2M couldn't be clicked

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer.

after the command box appeared, this popped up:

c:\windows\system32\cmd.exe
c:\windows\SYSTEM32\AUTOEXEC.NT.
the system file is not suitable for running MS_DOS and MS applications. choose 'Close' to terminate the application

l2mfix asked for a password but i clicked 'enter'. after reboot:

L2mfix 010406
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
zip warning: name not matched: dlls\*.*

zip error: Nothing to do! (backup.zip)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)

[Budfred]

that didnt work, Look2Me-Remover's Scan for L2M couldn't be clicked

I am not sure what you mean... Did you try it in Safe Mode??

I don't know what all that other stuff means and what you are quoting versus what you are saying... Please post a fresh HJT log and let me know if you are still having the popups...