Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

Hijack Log

Options
CluelessOne
CluelessOne
edited November 2008 in Logs analysis

Ok, so I got attacked yesterday and couldn't do a thing to stop it. (pop ups everywhere and "gayporn" icons and what not on my desktop and changed my wallpaper.. I'm totally clueless about removing viruses and spyware etc.


I use [removed]. I saw it quarantined backdoor trojans and a worm or another trojan when I was being bombarded by spam, but I'm still not sure if my system is safe or completely rid of it.. I tried everything, scanning, removing.


So I did a system restore back to yesterday and now disabled system restore. I'm at a wits end. I googled everything and learnt a bit.. (by the way, everything seems to be working perfectly fine again.. only startup was a bit slow.. my browser URL wouldn't react to "enter".. basically, the whole system feels slower.


So.. Here's my HijackThis log. I'm really not sure what is going on anymore.. Please help!


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 09:11:12, on 11/08/2008


Platform: Windows XP SP2 (WinNT 5.01.2600)


MSIE: Internet Explorer v7.00 (7.00.6000.16674)


Boot mode: Normal


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\spoolsv.exe


C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe


C:\WINDOWS\Explorer.EXE


C:\WINDOWS\system32\nvsvc32.exe


C:\Program Files\Dell Support Center\bin\sprtsvc.exe


C:\Program Files\DellTPad\Apoint.exe


C:\WINDOWS\system32\rundll32.exe


C:\WINDOWS\system32\RUNDLL32.EXE


C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe


C:\WINDOWS\RTHDCPL.EXE


C:\Program Files\Dell\QuickSet\quickset.exe


C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe


C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe


C:\WINDOWS\regx32.exe


C:\Program Files\DellTPad\ApMsgFwd.exe


C:\Program Files\Dell Support Center\bin\sprtcmd.exe


C:\Program Files\DellTPad\HidFind.exe


C:\Program Files\DellTPad\Apntex.exe


C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe


C:\WINDOWS\system32\ctfmon.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\Mozilla Firefox\firefox.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\WINDOWS\system32\wuauclt.exe


C:\WINDOWS\system32\wuauclt.exe


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/hws/sb/dell-usuk/e...?channel=uk-smb


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk/hws/sb/dell-usuk/e...?channel=uk-smb


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.co.uk/hws/sb/dell-usuk/e...?channel=uk-smb


R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll


O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe


O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet


O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start


O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit


O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"


O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE


O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe


O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"


O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"


O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice


O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\regx32.exe


O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE


O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_2] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmnetmgr.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_3] C:\WINDOWS\system32\regsvr32 /s /u "C:\WINDOWS\system32\wmv8dmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_4] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmvdmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_5] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmvdmoe2.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_6] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmadmoe.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_7] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmspdmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_8] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmspdmoe.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_9] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmsdmoe.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_10] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmsdmoe2.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_20] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmadmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_21] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\mpg4dmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_22] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\mp43dmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_23] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\mp4sdmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_24] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmsdmod.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_30] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\laprxy.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_31] "C:\WINDOWS\system32\logagent.exe" /RegServer


O4 - HKLM\..\RunOnce: [OE_WMPWMFSDK_Install_32] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmvcore.dll"


O4 - HKLM\..\RunOnce: [OE_WMPDRM_Install_1] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\drmstor.dll"


O4 - HKLM\..\RunOnce: [OE_WMPDRM_Install_2] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\drmclien.dll"


O4 - HKLM\..\RunOnce: [OE_WMPDRM_Install_4] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\drmv2clt.dll"


O4 - HKLM\..\RunOnce: [OE_WMPDRM_Install_5] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\blackbox.dll"


O4 - HKLM\..\RunOnce: [OE_WMPDRM_Install_6] C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\msnetobj.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_0] C:\WINDOWS\INF\unregmp2.exe /MigrateLibrary


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_1] "C:\Program Files\Windows Media Player\migrate.exe" /s


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_2] C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmp.dll


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_8] C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmpshell.dll


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_9] C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmpasf.dll


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_10] C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmpdxm.dll


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_11] C:\WINDOWS\system32\regsvr32 /s "C:\Program Files\Windows Media Player\mpvis.dll"


O4 - HKLM\..\RunOnce: [OE_WMPWMDM_Install_7] C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\mspmsnsv.dll


O4 - HKLM\..\RunOnce: [OE_WMPWMP7_Install_20] C:\WINDOWS\INF\unregmp2.exe /Shortcuts /RegExts


O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler


O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - HKCU\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"


O4 - HKCU\..\RunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"


O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')


O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O17 - HKLM\System\CCS\Services\Tcpip\..\{AB916561-C89D-4DE9-877E-36062AB5CB7F}: NameServer = 192.168.2.1


O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe


O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe


O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe


--


End of file - 10735 bytes


and here's the startup one


StartupList report, 11/08/2008, 09:15:21


StartupList version: 1.52.2


Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE


Detected: Windows XP SP2 (WinNT 5.01.2600)


Detected: Internet Explorer v7.00 (7.00.6000.16674)


* Using default options


==================================================


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\spoolsv.exe


C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe


C:\WINDOWS\Explorer.EXE


C:\WINDOWS\system32\nvsvc32.exe


C:\Program Files\Dell Support Center\bin\sprtsvc.exe


C:\Program Files\DellTPad\Apoint.exe


C:\WINDOWS\system32\rundll32.exe


C:\WINDOWS\system32\RUNDLL32.EXE


C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe


C:\WINDOWS\RTHDCPL.EXE


C:\Program Files\Dell\QuickSet\quickset.exe


C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe


C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe


C:\WINDOWS\regx32.exe


C:\Program Files\DellTPad\ApMsgFwd.exe


C:\Program Files\Dell Support Center\bin\sprtcmd.exe


C:\Program Files\DellTPad\HidFind.exe


C:\Program Files\DellTPad\Apntex.exe


C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe


C:\WINDOWS\system32\ctfmon.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\Mozilla Firefox\firefox.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\WINDOWS\system32\wuauclt.exe


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


C:\WINDOWS\system32\NOTEPAD.EXE


--------------------------------------------------


Listing of startup folders:


Shell folders Common Startup:


[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]


Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe


--------------------------------------------------


Checking Windows NT UserInit:


[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]


UserInit = C:\WINDOWS\system32\userinit.exe,


--------------------------------------------------


Autorun entries from Registry:


HKLM\Software\Microsoft\Windows\CurrentVersion\Run


Apoint = C:\Program Files\DellTPad\Apoint.exe


NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


nwiz = nwiz.exe /installquiet


NVHotkey = rundll32.exe nvHotkey.dll,Start


NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit


SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"


RTHDCPL = RTHDCPL.EXE


Alcmtr = ALCMTR.EXE


Dell QuickSet = C:\Program Files\Dell\QuickSet\quickset.exe


Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


dscactivate = "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"


PDVDDXSrv = "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"


egui = "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice


TrialReset = C:\WINDOWS\regx32.exe


IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


IMEKRMIG6.1 = C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE


MSPY2002 = C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


PHIME2002ASync = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


PHIME2002A = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


DellSupportCenter = "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


--------------------------------------------------


Autorun entries from Registry:


HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce


OE_WMPWMFSDK_Install_2 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmnetmgr.dll"


OE_WMPWMFSDK_Install_3 = C:\WINDOWS\system32\regsvr32 /s /u "C:\WINDOWS\system32\wmv8dmod.dll"


OE_WMPWMFSDK_Install_4 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmvdmod.dll"


OE_WMPWMFSDK_Install_5 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmvdmoe2.dll"


OE_WMPWMFSDK_Install_6 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmadmoe.dll"


OE_WMPWMFSDK_Install_7 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmspdmod.dll"


OE_WMPWMFSDK_Install_8 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmspdmoe.dll"


OE_WMPWMFSDK_Install_9 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmsdmoe.dll"


OE_WMPWMFSDK_Install_10 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmsdmoe2.dll"


OE_WMPWMFSDK_Install_20 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmadmod.dll"


OE_WMPWMFSDK_Install_21 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\mpg4dmod.dll"


OE_WMPWMFSDK_Install_22 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\mp43dmod.dll"


OE_WMPWMFSDK_Install_23 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\mp4sdmod.dll"


OE_WMPWMFSDK_Install_24 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmsdmod.dll"


OE_WMPWMFSDK_Install_30 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\laprxy.dll"


OE_WMPWMFSDK_Install_31 = "C:\WINDOWS\system32\logagent.exe" /RegServer


OE_WMPWMFSDK_Install_32 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\wmvcore.dll"


OE_WMPDRM_Install_1 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\drmstor.dll"


OE_WMPDRM_Install_2 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\drmclien.dll"


OE_WMPDRM_Install_4 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\drmv2clt.dll"


OE_WMPDRM_Install_5 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\blackbox.dll"


OE_WMPDRM_Install_6 = C:\WINDOWS\system32\regsvr32 /s "C:\WINDOWS\system32\msnetobj.dll"


OE_WMPWMP7_Install_0 = C:\WINDOWS\INF\unregmp2.exe /MigrateLibrary


OE_WMPWMP7_Install_1 = "C:\Program Files\Windows Media Player\migrate.exe" /s


OE_WMPWMP7_Install_2 = C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmp.dll


OE_WMPWMP7_Install_8 = C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmpshell.dll


OE_WMPWMP7_Install_9 = C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmpasf.dll


OE_WMPWMP7_Install_10 = C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\wmpdxm.dll


OE_WMPWMP7_Install_11 = C:\WINDOWS\system32\regsvr32 /s "C:\Program Files\Windows Media Player\mpvis.dll"


OE_WMPWMDM_Install_7 = C:\WINDOWS\system32\regsvr32 /s C:\WINDOWS\system32\mspmsnsv.dll


OE_WMPWMP7_Install_20 = C:\WINDOWS\INF\unregmp2.exe /Shortcuts /RegExts


--------------------------------------------------


Autorun entries from Registry:


HKCU\Software\Microsoft\Windows\CurrentVersion\Run


ISUSPM = "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler


DellSupportCenter = "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe


--------------------------------------------------


Autorun entries from Registry:


HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce


TSClientMSIUninstaller = cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"


TSClientAXDisabler = cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"


--------------------------------------------------


Autorun entries in Registry subkeys of:


HKLM\Software\Microsoft\Windows\CurrentVersion\Run


[OptionalComponents]


=


--------------------------------------------------


Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:


Shell=*INI section not found*


SCRNSAVE.EXE=*INI section not found*


drivers=*INI section not found*


Shell & screensaver key from Registry:


Shell=Explorer.exe


SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr


drivers=*Registry value not found*


Policies Shell key:


HKCU\..\Policies: Shell=*Registry key not found*


HKLM\..\Policies: Shell=*Registry value not found*


--------------------------------------------------


Enumerating Browser Helper Objects:


(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}


(no name) - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}


(no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045}


Browser Address Error Redirector - C:\Program Files\Dell\BAE\BAE.dll - {CA6319C0-31B7-401E-A518-A07C3DB8F777}


--------------------------------------------------


Enumerating ShellServiceObjectDelayLoad items:


PostBootReminder: C:\WINDOWS\system32\SHELL32.dll


CDBurn: C:\WINDOWS\system32\SHELL32.dll


WebCheck: C:\WINDOWS\system32\webcheck.dll


SysTray: C:\WINDOWS\system32\stobject.dll


UPnPMonitor: C:\WINDOWS\system32\upnpui.dll


--------------------------------------------------


End of report, 9,302 bytes


Report generated in 0.062 seconds


Command line options:


/verbose - to add additional info on each section


/complete - to include empty sections and unsuspicious data


/full - to include several rarely-important sections


/force9x - to include Win9x-only startups even if running on WinNT


/forcent - to include WinNT-only startups even if running on Win9x


/forceall - to include all Win9x and WinNT startups, regardless of platform


/history - to list version history only


Please help.


Thank you for your time.


Please get back to me asap if anyone can.. Please.

Comments

  • CluelessOne
    CluelessOne
    Options

    Sorry! I was in a state of panic and just posted without looking at the "how to post", I realised I didn't have "show hidden files" enabled.


    So now I have enabled it and done another HJT log.


    I couldn't find the "close thread" option.. sorry for the double posting.


    Here is the log now with hidden files enabled log.


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 14:14:13, on 11/08/2008


    Platform: Windows XP SP3 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16674)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe


    C:\WINDOWS\system32\nvsvc32.exe


    C:\Program Files\Dell Support Center\bin\sprtsvc.exe


    C:\WINDOWS\Explorer.EXE


    C:\Program Files\DellTPad\Apoint.exe


    C:\WINDOWS\system32\rundll32.exe


    C:\WINDOWS\system32\RUNDLL32.EXE


    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe


    C:\WINDOWS\RTHDCPL.EXE


    C:\Program Files\Dell\QuickSet\quickset.exe


    C:\Program Files\DellTPad\ApMsgFwd.exe


    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe


    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe


    C:\WINDOWS\regx32.exe


    C:\Program Files\DellTPad\HidFind.exe


    C:\Program Files\DellTPad\Apntex.exe


    C:\Program Files\Dell Support Center\bin\sprtcmd.exe


    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\WINDOWS\System32\svchost.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/hws/sb/dell-usuk/e...?channel=uk-smb


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk/hws/sb/dell-usuk/e...?channel=uk-smb


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.co.uk/hws/sb/dell-usuk/e...?channel=uk-smb


    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://partnerpage.google.com/smallbiz.del...amp;ibd=5080806


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll


    O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe


    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet


    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start


    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit


    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"


    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE


    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe


    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"


    O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"


    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice


    O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\regx32.exe


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE


    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


    O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler


    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


    O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O17 - HKLM\System\CCS\Services\Tcpip\..\{AB916561-C89D-4DE9-877E-36062AB5CB7F}: NameServer = 192.168.2.1


    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe


    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe


    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe


    --


    End of file - 6884 bytes

  • csalgau
    csalgau ✭✭
    Options

    Please find the file C:\WINDOWS\regx32.exe, put it in a ZIP archive with the password infected and attach it to your next post.

  • CluelessOne
    CluelessOne
    Options

    I ran a smitfraudfix while I waited for a reply but I didn't do it in safemode and done it again in safemode . (sadly the log file was saved over so the original one which I saw had removed at least 3 error things is not there anymore). So I'm not sure if it will affect anything..


    Thank you for helping, deeply appreiciate it.


    I will wait for further instructions.

    /applications/core/interface/file/attachment.php?id=2617" data-fileid="2617" rel="">regx32.rar

  • alexcrist
    alexcrist ✭
    Options

    The attached file is apparently clean.


    Try to make an scan with BitDefender Online Scan (works only with Internet Explorer). After the scan is finished, please attach the scan log.


    Also, attach a log of smitfraudfix (the one that you already have). Since you say you ran it twice, can you remember (at least partially) what were the results of the first scan?


    Cris.

  • Niels
    Niels ✭
    Options

    Hello Totally Clueless,


    Can you please download combofix you will find it here. Print the following instructions and read them carefully. Please post the output of the scan into your next post. So I or someone else can see if there is still some infections.


    Kind regards,


    Niels

  • CluelessOne
    CluelessOne
    Options

    Cris: I have attached the BitDefender Log, the "clean" parts is where I carelessly clicked the "show scanned files" bit :wacko:


    about the smitfraudfix log, I've included that too.


    I really can't remember it much.. but I THINK under


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    there was about 3 files that was .. (not sure - fuzzy memory) a fake windows antivirus firewall ( this poped up when I was attacked and disabled me from clicking anything outside the fake installer)


    Niels:


    I am a bit confused about the guide to using ComboFix.


    I have Windows XP Pro which was preinstalled by DELL (it was an option I paid an extra fee for) They didn't include a CD for me but gave me Vista for when I want to upgrade my OS later.


    In the ComboFix guide it tells :


    "At that page, scroll down and click on the appropriate download for your version of Windows XP (Home or Professional) and the service pack level that you have installed. When you click on the link to download the file, make sure you save it directly to your desktop. If you are using Windows XP Service Pack 3 (SP3), then select the Service Pack 2 download. "


    I'm using SP3 now


    This is Step 1 on http://support.microsoft.com/kb/310994


    There's Windows XP original release and then there's the Windows XP Service Pack (SP 1 or 2)


    So there's 4 links.. I know I need to download Windows XP Pro but do I download the original release one or the one that says the SP or both? bit confused here, I don't want to do anything wrong since the warning in the ComboFix guide was pretty scary :o:( if anything went wrong..

    /applications/core/interface/file/attachment.php?id=2637" data-fileid="2637" rel="">BitDefenderLog.html

    /applications/core/interface/file/attachment.php?id=2638" data-fileid="2638" rel="">rapport.txt

  • alexcrist
    alexcrist ✭
    edited August 2008
    Options

    Hello,


    BitDefender removed some infected files from your computer. There were no detected items that couldn't be removed, which is a good thing.


    The SmitfraudFix log is clean, as expected. No relevant info is contained in it, considering that it was ran twice.


    About Combofix, skip to the part where you actually run Combofix. The first part of the instructions are not necessary for a scan. Post the log after the scan is done.


    Cris.

  • Niels
    Niels ✭
    Options

    Hello Totally Clueless,


    You need to download this. That is only necessary if you want to recover from a faulty removal. But you can skip it like Cris said.


    Kind regards,


    Niels

  • CluelessOne
    CluelessOne
    Options

    Ok, I've skipped the download and just ran ComboFix.


    I have attached the log.


    When ComboFix rebooted my laptop my antivirus auto runs on start up so I had to turn it off. Not sure if that affects the scan (it was disabled during the scan).


    Thank you very much.


    I hope its clean :unsure:

    /applications/core/interface/file/attachment.php?id=2651" data-fileid="2651" rel="">ComboFix.txt

  • Niels
    Niels ✭
    Options

    Hello Totally Clueless,


    Sorry for the delay in response.


    These entries looks suspicious:


    C:\newfile.enc


    C:\newkey


    Can you please add them as an attachment. For the rest I couldn't find anything else. Do you still have problems?


    Kind regards,


    Niels

  • CluelessOne
    CluelessOne
    Options

    I tried to do some research on those files (well... just googling the files to see if it has been flagged as a virus/malware) and I came across this :


    http://forums.g4tv.com/thread.jspa?threadI...2&tstart=25


    Don't know if it's 100% accurate but it fits the profile. I am using a Dell Vostro 1710. IF it comes back as clean, just thought I would let you know so if you ever come across it again =)


    sorry for the late reply, I know you're busy. I thank you all VERY much, I really appreciate it *bows*


    I have attached the files anyways.


    I'm not having startup problems now except a slight lag when I open my internet browser (FireFox) but that would just be startup lag.


    I am concerned about regx32.exe though (I did some google-ing again)


    Thank you very much.

    /applications/core/interface/file/attachment.php?id=2783" data-fileid="2783" rel="">newkey.rar

  • Niels
    Niels ✭
    Options

    Hello Totally Clueless,


    The file regx32.exe seems related to reset the trial period of an antivirus but if the virus researchers says it isn't a threat there is not so much that I can do. You could be right that the files I wanted you to archive are harmless. For me they looked suspicious.


    Kind regards,


    Niels

  • CluelessOne
    CluelessOne
    Options

    Ahhh okies, I can just delete it maybe? or is there a particular way I have to use to remove it.


    Well, I'd like to thank you all very very much first of all for helping me :)

  • Niels
    Niels ✭
    Options

    Hello Totally Clueless,


    Please do this open task manager by pressing these 3 keys together: ctrl+alt+del(ete) or ctrl+left shift+esc(ape) be sure that the that the processes tab is high lighted now left click 1 time on the process name so everything will be sorted alphabetically now left click on the process called regx32.exe and press end task. After you have done that delete regx32.exe which you will find in the system 32 folder. Finally press the windows button together with r now type regedit press enter. Now expand (= left clicking on + ) on HKEY_LOCAL_MACHINE and expand the following folders and subfolders: software,microsoft,windows,current version,run. Now take a look at the right side of the screen and select an entry called regx32.exe now press on the delete button on your keyboard to delete it.


    Glad to hear that you appreciate my help. You are welcome.


    Kind regards,


    Niels

All Time Leaders

Categories

Defenders of the month