E2Give and others won't go away

thepicman · 2006-07-26, 00:29

Trying to fix a friends wife's computer. Started with over 3000 spybot entrys.

Here are the Hijack log The Virus log is in the next post. Please help, I've followed the To Do list on the forum. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 3:43:24 PM, on 7/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\msiexec.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\xjvas.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ifdedae.exe
O2 - BHO: (no name) - {24CDD264-853D-049B-DAFD-07894CF764E8} - C:\WINDOWS\Tknxcdpv.dll
O2 - BHO: (no name) - {34B5AF39-C3A6-9C5F-0FB7-15DC4E3D8B7F} - C:\WINDOWS\ofgi.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: KGhost - {968BC8A3-7660-4B12-B2BF-3334775835E1} - C:\Program Files\NetMeeting\KG\KGhost.dll
O2 - BHO: (no name) - {D4887992-E30C-C38E-7550-EA5B542F6192} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E3-E30E-CB86-7553-EE5B57296196} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E5-E30C-C381-7526-E95B51286191} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {DEB797C5-021A-4C2B-B490-F9B415179519} - C:\Program Files\Internet Explorer\pocevyhi.dll (file missing)
O2 - BHO: (no name) - {FBD2EBD0-E6DF-456E-B300-A4D10A90C683} - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot
O4 - HKLM\..\Run: [C:\WINDOWS\fewazsot.exe] C:\WINDOWS\fewazsot.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [mszvdll] C:\WINDOWS\mszvdll.EXE
O4 - HKLM\..\Run: [qccaenc] C:\WINDOWS\qccaenc.EXE
O4 - HKLM\..\Run: [fdrpdll] C:\WINDOWS\fdrpdll.EXE
O4 - HKLM\..\Run: [fdrpenc] C:\WINDOWS\fdrpenc.EXE
O4 - HKLM\..\Run: [dhWin1.exe] dhWin1.exe
O4 - HKLM\..\Run: [qjikdll] C:\WINDOWS\qjikdll.EXE
O4 - HKLM\..\Run: [qjikenc] C:\WINDOWS\qjikenc.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [adstart] iexplore.exe http://__adstart
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.snipernet.us
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.errorsafe.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.media-motor.net (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.snipernet.us (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted Zone: *.winfixer.com (HKLM)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...4/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O20 - AppInit_DLLs: iniwin32.dll,inicfg32.dll,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

thepicman · 2006-07-26, 00:29

#Trend Micro HouseCall - Storage of detected incidents
#Sat Jul 22 16:05:48 GMT-06:00 2006
scanned.pattern.type=malware,grayware,system.grayware,vulnerability.software
system.username=Administrator
infectivethreats.failed.reason=unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown
infectivethreats.type=
created=2006-07-22 06\:44\:30 GMT-06\:00
personalize=false
infectivethreats.amount=1,1,1,1,1,1,1,1,2,1,2,1,2,1,1,1,1,2,1,6,1,2,1,1,1,1,1,2,2,2,1,1,1,1,1,1,1,2,6,1,1,2,1,1,6,2,1,1,2,1,6,1,1,1,1,1,1,1,2,1,2,2,1,1,1,1,1,2,1,1,3,1,1,1,1,2,2,1,1,3,1,10,1,1,1,2,1,1,1,1,1,1,1,1,50,2,1,1,27,3,4,1,1,3,1,1,1,1,3,1,2,1,2,5,2,1,1,2,1,1,3,1,1,5,7,1,1,1,1,1,1,1,2,1,1,1,2,2,22,1,3,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,3,1,1,1,1,3,1,1,1,4,4,1,1,1,1,1,1,5,1,1,2,1,1,2,1,1,2,2,1,3,1,1,1,1,1,1,2,1,1,1,1,2,1,2,7,1,2,1,1,1,1,3,1,1,3,18,2,1,1,1,1,1,1,1,1,2,1,1,1,5,4,3,1,1,1,3,1,1,1,2
vulnerabilities.type=software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software
system.ip=192.168.1.118
scanned.pattern.version=359100,39300,38500,4600
system.architecture=x86
infectivethreats.class=malware,grayware,grayware,grayware,grayware,malware,grayware,grayware,malware,grayware,malware,malware,grayware,grayware,malware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,malware,grayware,malware,malware,grayware,malware,grayware,malware,grayware,malware,grayware,grayware,malware,malware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,malware,grayware,malware,grayware,grayware,malware,grayware,grayware,grayware,grayware,malware,grayware,grayware,grayware,grayware,malware,grayware,malware,grayware,grayware,malware,grayware,malware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,malware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,malware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,malware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,grayware,grayware,malware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,malware,malware,malware,malware,malware,grayware,grayware,malware,malware,grayware,malware,grayware,grayware,grayware,malware,grayware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,malware,grayware,grayware,malware,grayware,malware,grayware,grayware,grayware,malware,malware,malware,grayware,grayware,grayware,malware,grayware,grayware,malware,malware,malware,grayware,malware,grayware,grayware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware
infectivethreats.failed.amount=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
infectivethreats.removed=1,1,1,1,1,1,1,1,1,1,2,1,2,1,1,1,1,2,1,0,1,0,0,1,1,1,1,2,2,0,1,1,1,1,1,1,1,2,6,1,1,1,1,1,6,2,1,1,2,1,6,1,1,1,1,1,1,1,2,1,2,2,1,1,1,1,1,2,1,1,3,1,1,1,1,2,2,1,1,3,1,10,1,1,1,2,1,0,1,1,1,1,1,1,50,1,1,1,27,3,4,1,1,0,1,1,1,1,3,1,2,1,2,5,2,1,1,2,1,1,3,1,1,5,7,0,1,1,1,1,1,1,2,1,0,1,2,2,22,1,3,1,1,1,1,1,1,1,2,1,1,1,1,1,1,1,1,1,0,1,1,1,1,0,1,1,1,4,0,1,1,1,1,1,1,4,1,1,2,1,0,2,1,1,2,2,1,3,1,1,1,1,1,1,2,1,1,1,1,0,1,2,7,1,2,1,1,1,1,3,1,1,3,18,2,1,1,1,1,1,1,1,1,2,1,1,1,5,4,2,1,1,1,3,1,1,1,2
scanned.count=143736,143736,49953,150
scanned.engine.version=800001001,800001001,330001048,398001012
infectivethreats=TROJ_SMALL.GO,ADWARE_ABETTERINTERNET,COOKIE_STARWARE,ADW_EZULA.B,COOKIE_PARTYPOKER,TROJ_VB.CAC,ADW_SURFKICK.Q,ADW_ICONADS.A,PE_GENERIC,ADW_WWBARS.A,BKDR_BDI.A,TROJ_SCTHOUGHT.L,ADW_APROPOS.M,ADW_CMAPP.C,TROJ_ALCHEMIC.A,TROJ_STILEN.A,ADW_ADDESTROY.A,ADW_SAHAGENT.A,ADWARE_IBIS.WEBSEARCH,JAVA_BYTEVER.AB,TROJ_DROPPER.YY,ADW_MYSEARCH.202,ADWARE_MAXIFILES,TROJ_VB.AGZ,COOKIE_ZEDO,TROJ_SMALL.IQ,TROJ_RK.A,ADW_EXSEARCH.A,TROJ_SMALL.JI,ADW_WINPUP32.A,TROJ_DROPPER.XV,SPYW_PPNETWORK.B,TROJ_ADCLICKER.A,ADW_FCHELP.A,ADW_SRCHENH.A,TROJ_DLOADER.C,TROJ_CLICKER.JA,TROJ_SMALL.XC,ADW_SOLU180.A,ADWARE_CLEARSEARCH,ADW_DEALHELPER.E,WORM_GENERIC,TROJ_AGENT.AWP,SPYW_IESEARCH.A,ADW_SAFESURF.J,ADW_SAFESURF.G,ADW_DOWNLOADER.C,TROJ_VB.DB,ADW_SAFESURF.H,TROJ_MIDADDLE.A,ADW_BCPC.A,ADWARE_MIDADDLE,TROJ_DROPPER.UF,ADWARE_EZULA,TSPY_AGENT,ADWARE_MEDIAMOTOR,ADWARE_ALTNET,TROJ_SMALL.AXZ,ADW_SAFESURF.F,ADW_TVMEDIA.DR,ADW_FLASHTRCK.A,ADW_MEDTICKS.R,TROJ_VB.KQ,ADW_BITLOCKER.AA,TROJ_DLDR.2,ADWARE_TOTALVELOCITY,ADWARE_POPSSTOP,TROJ_AGENT.BT,ADWARE_ENBROWSER,TSPY_AGENT.L,ADW_DEALHELP.A,ADWARE_WINTOOLS,ADWARE_SHORTY,ADWARE_2NDTHOUGHT,ADW_BOTCER.A,TROJ_TVMEDIA.DR,TROJ_DELF.MC,ADW_WINFETCHER.A,SPYW_AGENT.A,ADW_SIDEKICK.B,ADWARE_BHOT_HUNTBAR,BKDR_HACDEF.AK,COOKIE_EXITEXCHANGE,TROJ_DLOADER.CRU,TROJ_DLOADER.BWW,ADW_SURFKICK.A,ADW_SURFKICK.O,ADW_ALTNET.C,ADWARE_ZQUEST,ADW_CMAPP.A,ADWARE_BHOT_E-VENTURES,TROJ_DROPPER.ABD,ADW_TVMEDIA.I,ADWARE_E2G,TROJ_SMALL.ID,TROJ_GENERIC,ADWARE_AVENUEMEDIANV,ADW_MYDLYSCOPE.A,ADW_SAFESURF.AE,ADW_DELFINMED.A,ADW_ELITEMEDIA.A,ADWARE_SAFESURF,ADW_BITLOCKER.AD,JAVA_BYTEVER.AC,TROJ_SMALL.AFA,ADW_SOFTOMATE.B,ADW_SAFESURF.AD,ADW_STC.A,ADW_MIDADDLE.B,DOWNLOADER_SMALL,ADW_IPEND.A,ADWARE_BEGIN2SEARCH,ADW_SAFESURF.AG,ADW_SURFKICK.U,TROJ_VB.ADP,TROJ_DLDR.CA,ADW_BITLOCKER.AC,SPYW_WEBSEARCH.G,ADWARE_COMMONCOMPONENTS,ADWARE_SYSNET,ADW_VIRTUMONDO.D,TROJ_SMALL.AQC,ADWARE_DYFUCA,TROJ_DLOADER.BE,ADW_ADCLICKER.A,ADW_TOPSEARCH.A,ADW_ESYN.A,ADWARE_DRSNSRCH,ADW_MIDADDLE.C,ADWARE_BROADCASTPC,FREELOADER_SPYWARELABS,ADWARE_CLIENTMAN,ADW_BINET.B,ADW_PASSIVECOW.A,TROJ_BISPY.D,TROJ_AGENT.AXT,ADW_WILDMEDIA.A,TROJ_VB.AMZ,ADW_WINSTOOL.B,SPYW_TWANT.E,ADW_SIDESEARCH.A,ADW_PWRSEARCH.A,HKTL_PROCKILL.A,ADW_TARGETSAV.C,ADWARE_VISFX,SPYW_VTBOUNCER.A,ADW_OVERPRO.A,ADWARE_SURFSIDEKICK,ADW_IMISERV.C,SPYW_CLEARSRCH.A,ADW_SCANPORTAL.A,ADWARE_EZULA.ILOOKUP,ADW_STATBLAST.A,TROJ_UPLOADER.F,TROJ_ZAPCHAST.J,ADW_IPWINS.A,ADWARE_APROPOS,COOKIE_SEARCHINGBOOTH,JAVA_BYTEVER.A,TROJ_QOOLOGIC.AI,ADWARE_DEALHELPER,ADW_QUICKBROWS.A,ADW_EGIV.A,ADW_WSEARCH.109,TROJ_DLOADER.AVG,TROJ_DLOADR.AA,TROJ_VB.AMJ,TROJ_TSUPDATE.G,JAVA_FEMAD.B,ADW_STATBLASTE.A,ADWARE_FLASHENHANCER,TROJ_DROPPER.YR,TROJ_NASCENE.Y,SPYW_CLIENTMAN.A,ADW_DOWNLD.A,SPYW_BISPY.A,COOKIE_YIELDMANAGER,SPYW_DYFUCA.E,TROJ_DYFUCA.I,ADW_BIGTRAFFIC.B,TROJ_STUBBY.D,SPYW_E2GIVE.A,SPYW_TWANT.A,COOKIE_FALKAG,TROJ_HACDEF.BS,CHM_SYSDOC.B,ADW_CMDDSKTOP.A,ADW_NETPALS.A,ADWARE_SUPERLOGY,ADWARE_SEARCHEXPLORER,ADWARE_WILDMEDIA,ADWARE_P2PNETWORK,ADWARE_BHO_SEP,ADW_WEBSEARCH.C,JS_ADCLICKER.BK,TROJ_REVOP.A,TROJ_DLOADER.ALW,TSPY_DROPPER.7,SPYW_WEBHANCER.A,JAVA_BYTEVER.A-1,ADW_COMMAD.A,CHM_SNIPLOAD.A,ADW_APROPOS.51,SPYW_CLIENTMAN.D,ADW_EXACTSER.A,TSPY_DLOADER.DG,TROJ_DYFUCA.AA,TROJ_SMALL.GV,ADW_ADROAR.A,ADW_TVMEDIA.C,COOKIE_TACODA,TROJ_APROPO.C,ADW_BCPC.B,ADW_NCASE.A,TROJ_IMISERV.C,TROJ_RVP.D,TROJ_MULTIDRP.BR,ADW_BB.A,TROJ_AGENT.CAC,ADWARE_SEARCHTOOLBAR,SPYW_MARKTSCOR.A,TROJ_APROPO.D,ADWARE_BESTOFFERS,SPYW_STINTER.A,ADWARE_SIDEFIND,COOKIE_REVSCI,ADWARE_ADROAR,ADW_SAFESURF.D,ADW_FLASHTRACK.E,ADW_LINKMAKER.D,ADW_BGN2SEARCH.A,TSPY_PRUTEC,ADWARE_CONSUMERALERTSYSTEM,ADW_FLASHTRACK.F,ADWARE_DELFINMED,ADWARE_FLASHTRACK,COOKIE_ADDYNAMIX,CHM_MEDTICKS.U
scanned.engine.type=main,main,system,system
vulnerabilities=MS06-007,MS05-004,MS06-005,MS05-048,MS05-049,MS05-047,MS05-039,MS05-037,MS05-025,MS05-026,MS05-040,MS05-036,MS05-043,MS05-042,MS06-016,MS05-041,MS06-015,MS06-013,MS06-014,MS06-018,MS05-045,MS06-030,MS05-038,MS06-032,MS05-027,MS05-052,MS04-041,MS05-054,MS06-002,MS05-053,MS06-023,MS06-022,MS05-051,MS06-021,MS05-050,MS06-025,MS05-032,MS06-008,MS06-001,MS05-033,MS06-006
send.report.key=5491081
infectivethreats.failed=false,true,true,false,true,false,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,false,true,false,true,false,false,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,false,false,false,false,false,false,false,false,false,true,false,true,true,true,true,false,false,false,false,false,false,false,false,true,true,false,true,false,false,true,true,true,false,false,false,false,false,false,true,false,true,false,false,false,false,false,true,false,true,false,false,true,false,false,true,false,false,false,false,true,false,false,false,false,false,false,false,true,false,true,false,false,false,false,false,false,true,true,false,false,true,false,false,false,false,true,false,true,true,true,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,true,false,false,false,true,false,false,false,false,true,true,false,false,true,false,false,false,false,false,false,false,false,false,true,false,false,false,false,false,true,false,false,false,false,false,false,true,false,false,false,false,true,true,true,true,true,false,false,false,false,true,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,false,false,false,false,false,false,true,false,false,true,false,true,true,true,false,false,false,false,true,true,false,true,true,true,false
domain=housecall65.trendmicro.com
implementation=html/java

pskelley · 2006-07-26, 03:44

Hello and welcome to the forum. I will say first that I have no idea what you posted from Housecall, that looks like to scan report I have ever seen??

You have quite a mess here, a bit of everything including E2Give and a Qoologic trojan. I really suggest you stay offline until you are clean, this junk will attract others and you have your share just now. This will be work, you must follow the directions carefully if you want the fixes to work. We will try to remove E2Give, then Qoologic and one run through with HJT and stop to see where we are. I want to say this is nothing to rush through, be careful. If this seem like something you wish to do, here we go.

1) Please download E2TakeOut by Rubber Ducky from here:

http://www.malwarebytes.org/E2TakeOut.zip

Extract the file to your Desktop
Double click E2TakeOut.exe
Click the Begin Removal button
Wait until the program is finished scanning
Once done, it will produce a popup stating that the infection has been found and you need to reboot you computer to complete the removal
Reboot your computer
Once your computer has rebooted E2TakeOut will open and produce a report
Please copy/paste that report into your next reply

2) Credit to Rubber Ducky for the tool...and Lonny for the original fix.
Please download Qoofix by Rubber Ducky to your desktop.

Right click on the Qoofix folder, and choose "Extract All". Extract Qoofix to your C: drive
Close all windows and programs, including internet windows.
Go to C:\Qoofix and open the folder, then double click on Qoofix.exe
Click Begin Removal and wait for the scan to finish
If Qoofix finds an infection, select yes to restart your computer
You will now find a log from this tool, located at C:\Qoofix\Qoofix Logfile.txt Copy and paste the contents of that report into your next reply here.

3) Trusted Zone removal: this will clean those bad 015 items:
Download the attached zip file and unzip it to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf
Right-click on the deldomains.inf file and select 'Install'

4) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

5) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

(some items will be gone, removed by the tools, not to be concerned, just don't miss any)

6) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\xjvas.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ifdedae.exe
O2 - BHO: (no name) - {24CDD264-853D-049B-DAFD-07894CF764E8} - C:\WINDOWS\Tknxcdpv.dll
O2 - BHO: (no name) - {34B5AF39-C3A6-9C5F-0FB7-15DC4E3D8B7F} - C:\WINDOWS\ofgi.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: KGhost - {968BC8A3-7660-4B12-B2BF-3334775835E1} - C:\Program Files\NetMeeting\KG\KGhost.dll
O2 - BHO: (no name) - {D4887992-E30C-C38E-7550-EA5B542F6192} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E3-E30E-CB86-7553-EE5B57296196} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E5-E30C-C381-7526-E95B51286191} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {DEB797C5-021A-4C2B-B490-F9B415179519} - C:\Program Files\Internet Explorer\pocevyhi.dll (file missing) G
O2 - BHO: (no name) - {FBD2EBD0-E6DF-456E-B300-A4D10A90C683} - (no file)
O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot
O4 - HKLM\..\Run: [C:\WINDOWS\fewazsot.exe] C:\WINDOWS\fewazsot.exe
O4 - HKLM\..\Run: [mszvdll] C:\WINDOWS\mszvdll.EXE
O4 - HKLM\..\Run: [qccaenc] C:\WINDOWS\qccaenc.EXE
O4 - HKLM\..\Run: [fdrpdll] C:\WINDOWS\fdrpdll.EXE
O4 - HKLM\..\Run: [fdrpenc] C:\WINDOWS\fdrpenc.EXE
O4 - HKLM\..\Run: [dhWin1.exe] dhWin1.exe
O4 - HKLM\..\Run: [qjikdll] C:\WINDOWS\qjikdll.EXE
O4 - HKLM\..\Run: [qjikenc] C:\WINDOWS\qjikenc.EXE
O4 - HKLM\..\Run: [adstart] iexplore.exe http://__adstart
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.snipernet.us
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.errorsafe.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.media-motor.net (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.snipernet.us (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted Zone: *.winfixer.com (HKLM)
O20 - AppInit_DLLs: iniwin32.dll,inicfg32.dll,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

Close all programs but HJT and all browser windows, then click on "Fix Checked"

7) RIGHT Click on Start then click on Explore. Locate and delete these items:

(All files may not be there, just DO NOT miss any)

C:\WINDOWS\fdrpdll.EXE
C:\WINDOWS\fdrpenc.EXE
C:\WINDOWS\fewazsot.exe
C:\WINDOWS\mszvdll.EXE
C:\WINDOWS\qccaenc.EXE
C:\WINDOWS\qjikdll.EXE
C:\WINDOWS\qjikenc.EXE
C:\WINDOWS\system32\irssyncd.exe
C:\WINDOWS\system32\ossproxy.exe

8) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

9) Restart the computer and post the report from E2TakeOut, C:\Qoofix\Qoofix Logfile.txt, a new HJT log and any comments you think will help. I will look at the information to see what is left to do as soon as possible after that.

Thanks...pskelley
Safer Networking Forums

thepicman · 2006-07-26, 17:11

Thanks! when installing the .inf file "windows cannot find grpconv" and everytime I right click, I get an install window saying "installing Defender Pro Anti Virus"?

E2TakeOut v1.01 [http://www.malwarebytes.org]

Removed! C:\WINDOWS\system32\inicfg32.dll
Removed! C:\WINDOWS\system32\iniwin32.dll
Removed directory and files! C:\Program Files\E2G
Removed orphaned leftovers
AppInit key reset

Qoofix v1.02 by http://www.malwarebytes.org
Scan started on [7/26/2006] at [8:27:46 AM]
-------------------------------------------------------------
Terminated module: nhevjdp.dll found in Qoofix.exe (3884)
Terminated module: nhevjdp.dll found in hafvsu.exe (2672)
Terminated module: nhevjdp.dll found in explorer.exe (2736)
Terminated module: nhevjdp.dll found in xjvas.exe (2816)
Terminated module: nhevjdp.dll found in xjvas.exe (2848)
Terminated module: nhevjdp.dll found in xjvas.exe (2856)
Terminated module: nhevjdp.dll found in hphmon05.exe (3144)
Terminated module: nhevjdp.dll found in HpqCmon.exe (3212)
-------------------------------------------------------------
C:\WINDOWS\system32\hafvsu.exe will be deleted on reboot!
C:\WINDOWS\system32\ifdedae.exe will be deleted on reboot!
C:\WINDOWS\system32\mxtye.dat will be deleted on reboot!
C:\WINDOWS\system32\nhevjdp.dll will be deleted on reboot!
C:\WINDOWS\system32\xjvas.exe will be deleted on reboot!
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\yhqwy.exe will be deleted on reboot!

User prompted YES to reboot, system now rebooting...
-------------------------------------------------------------
Scan COMPLETED SUCCESSFULLY on [7/26/2006] at [8:29:30 AM]

Note: Some registry keys may have been removed.

Logfile of HijackThis v1.99.1
Scan saved at 9:00:39 AM, on 7/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
C:\WINDOWS\system32\MsiExec.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...4/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

pskelley · 2006-07-26, 19:25

Seems you made some great progress

before I look at the log, I am interested in this message:

Quote:

windows cannot find grpconv

See this: http://www.liutilities.com/products/...brary/grpconv/
seems this is an important part of Author: Microsoft Corp.
Part Of: Microsoft Windows Operating System

I think before we move on you should run System File Checker to make sure there are no missing or corrupt windows files. Have your CD handy in case you are asked for it:
Click Start > Run, type in sfc /scannow, hit Enter.
Note: there is a space between sfc and /scannow
This should replace any corrupted/missing system files
http://www.updatexp.com/windows-file-protection.html
http://www.networkclue.com/os/Windows/commands/sfc.aspx
http://www.updatexp.com/scannow-sfc.html

Quote:

I get an install window saying "installing Defender Pro Anti Virus"?

Start > Control Panel > Add Remove programs and look for that item, uninstall it it there, uninstall anything that should not be there, if you are unsure, let me know and I will look.

I apologize, I missed a nasty: http://www.spywareguide.com/product_show.php?id=794 and it could have to do with the message. Let's do this:

See this to help with ATF-cleaner: http://forums.security-central.us/showthread.php?t=1925

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

(next two, download them fresh if you need them again)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
(next is the nasty I missed)
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Run ATF-Cleaner again, you will not need to clean Prefetch again (cleaning Prefetch will slow you a little until Windows repopulates it, so purging is only needed when you have cleaned out infections)

Post a last HJT log and let me know how the computer is performing now.

Thanks...Phil

thepicman · 2006-07-31, 17:48

Phil, thanks for the help. Was OOT for a few days, will finish up and get back to you.

TPM

**tashi** · 2006-08-05, 19:36

Hi, how is it going with that computer.

thepicman · 2006-08-06, 01:01

Quote:

Originally Posted by pskelley

r that item, uninstall it it there, uninstall anything that should not be there, if you are unsure, let me know and I will look.

Post a last HJT log and let me know how the computer is performing now.

Thanks...Phil

I know how to unistall progs, I did not realize that was a "real" virus program, thought it was a spoof. It was never installed completely, so did not show in any of the normal places. Its gone now, ripped violently from the register

. I think this box may be better as well. Thanks for the help on the nasty bits!

Here is the hijack.

Logfile of HijackThis v1.99.1
Scan saved at 5:34:26 PM, on 8/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...4/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

pskelley · 2006-08-06, 02:34

Am I blind? Is there no active antivirus program running on this computer

Online scans will just not protect you. Here are some free ones and I suggest AVG by Grisoft:
http://free.grisoft.com/freeweb.php
http://www.avast.com/eng/avast_4_home.html
http://www.free-av.com/

The HJT log appears clean of malware, here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

Safe surfing...tashi

will close the topic in a day or so.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

thepicman · 2006-08-06, 23:32

Quote:

Originally Posted by pskelley

Am I blind? Is there no active antivirus program running on this computer

Online scans will just not protect you.

Safe surfing...tashi

will close the topic in a day or so.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

Not you are not blind, I put Avast on it for her, but had not started it yet. I wanted you to see a clean hijack log before adding stuff to the process list. I am only doing this once for them, so I am safing it as much as I can for them. Thanks for your help!

TPM

2006-07-26, 00:29	#1
thepicman Junior Member Join Date: Jul 2006 Location: Bottom of a Gin Bottle Posts: 28	E2Give and others won't go away Trying to fix a friends wife's computer. Started with over 3000 spybot entrys. Here are the Hijack log The Virus log is in the next post. Please help, I've followed the To Do list on the forum. Thanks! Logfile of HijackThis v1.99.1 Scan saved at 3:43:24 PM, on 7/25/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\msiexec.exe C:\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file) F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\xjvas.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ifdedae.exe O2 - BHO: (no name) - {24CDD264-853D-049B-DAFD-07894CF764E8} - C:\WINDOWS\Tknxcdpv.dll O2 - BHO: (no name) - {34B5AF39-C3A6-9C5F-0FB7-15DC4E3D8B7F} - C:\WINDOWS\ofgi.dll O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: KGhost - {968BC8A3-7660-4B12-B2BF-3334775835E1} - C:\Program Files\NetMeeting\KG\KGhost.dll O2 - BHO: (no name) - {D4887992-E30C-C38E-7550-EA5B542F6192} - C:\WINDOWS\system32\sfsdb.dll (file missing) O2 - BHO: (no name) - {D58879E3-E30E-CB86-7553-EE5B57296196} - C:\WINDOWS\system32\sfsdb.dll (file missing) O2 - BHO: (no name) - {D58879E5-E30C-C381-7526-E95B51286191} - C:\WINDOWS\system32\sfsdb.dll (file missing) O2 - BHO: (no name) - {DEB797C5-021A-4C2B-B490-F9B415179519} - C:\Program Files\Internet Explorer\pocevyhi.dll (file missing) O2 - BHO: (no name) - {FBD2EBD0-E6DF-456E-B300-A4D10A90C683} - (no file) O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot O4 - HKLM\..\Run: [C:\WINDOWS\fewazsot.exe] C:\WINDOWS\fewazsot.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [mszvdll] C:\WINDOWS\mszvdll.EXE O4 - HKLM\..\Run: [qccaenc] C:\WINDOWS\qccaenc.EXE O4 - HKLM\..\Run: [fdrpdll] C:\WINDOWS\fdrpdll.EXE O4 - HKLM\..\Run: [fdrpenc] C:\WINDOWS\fdrpenc.EXE O4 - HKLM\..\Run: [dhWin1.exe] dhWin1.exe O4 - HKLM\..\Run: [qjikdll] C:\WINDOWS\qjikdll.EXE O4 - HKLM\..\Run: [qjikenc] C:\WINDOWS\qjikenc.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [adstart] iexplore.exe http://__adstart O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: .adgate.info O15 - Trusted Zone: .dollarrevenue.com O15 - Trusted Zone: .elitemediagroup.net O15 - Trusted Zone: .errorsafe.com O15 - Trusted Zone: .imagesrvr.com O15 - Trusted Zone: .matcash.com O15 - Trusted Zone: .media-motor.com O15 - Trusted Zone: .mediatickets.net O15 - Trusted Zone: .snipernet.biz O15 - Trusted Zone: .snipernet.us O15 - Trusted Zone: .systemdoctor.com O15 - Trusted Zone: .winantivirus.com O15 - Trusted Zone: .winfixer.com O15 - Trusted Zone: .adgate.info (HKLM) O15 - Trusted Zone: .dollarrevenue.com (HKLM) O15 - Trusted Zone: .elitemediagroup.net (HKLM) O15 - Trusted Zone: .errorsafe.com (HKLM) O15 - Trusted Zone: .imagesrvr.com (HKLM) O15 - Trusted Zone: .matcash.com (HKLM) O15 - Trusted Zone: .media-motor.com (HKLM) O15 - Trusted Zone: .media-motor.net (HKLM) O15 - Trusted Zone: .mediatickets.net (HKLM) O15 - Trusted Zone: .snipernet.biz (HKLM) O15 - Trusted Zone: .snipernet.us (HKLM) O15 - Trusted Zone: .systemdoctor.com (HKLM) O15 - Trusted Zone: .winantivirus.com (HKLM) O15 - Trusted Zone: *.winfixer.com (HKLM) O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...4/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1092959613625 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab O20 - AppInit_DLLs: iniwin32.dll,inicfg32.dll, O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

2006-07-26, 03:44	#3
pskelley In Memoriam -Always in our heart Join Date: Oct 2005 Location: Clearwater, Florida Posts: 20,559	Hello and welcome to the forum. I will say first that I have no idea what you posted from Housecall, that looks like to scan report I have ever seen?? You have quite a mess here, a bit of everything including E2Give and a Qoologic trojan. I really suggest you stay offline until you are clean, this junk will attract others and you have your share just now. This will be work, you must follow the directions carefully if you want the fixes to work. We will try to remove E2Give, then Qoologic and one run through with HJT and stop to see where we are. I want to say this is nothing to rush through, be careful. If this seem like something you wish to do, here we go. 1) Please download E2TakeOut by Rubber Ducky from here: http://www.malwarebytes.org/E2TakeOut.zip Extract the file to your Desktop Double click E2TakeOut.exe Click the Begin Removal button Wait until the program is finished scanning Once done, it will produce a popup stating that the infection has been found and you need to reboot you computer to complete the removal Reboot your computer Once your computer has rebooted E2TakeOut will open and produce a report Please copy/paste that report into your next reply 2) Credit to Rubber Ducky for the tool...and Lonny for the original fix. Please download Qoofix by Rubber Ducky to your desktop. Right click on the Qoofix folder, and choose "Extract All". Extract Qoofix to your C: drive Close all windows and programs, including internet windows. Go to C:\Qoofix and open the folder, then double click on Qoofix.exe Click Begin Removal and wait for the scan to finish If Qoofix finds an infection, select yes to restart your computer You will now find a log from this tool, located at C:\Qoofix\Qoofix Logfile.txt Copy and paste the contents of that report into your next reply here. 3) Trusted Zone removal: this will clean those bad 015 items: Download the attached zip file and unzip it to your desktop. http://www.mvps.org/winhelp2002/DelDomains.inf Right-click on the deldomains.inf file and select 'Install' 4) How to make files and folders visible: Click Start > Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders. Uncheck: Hide file extensions for known file types Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK. 5) Please download ATF Cleaner by Atribune http://www.atribune.org/public-beta/ATF-Cleaner.exe Save it to your Desktop. We will use this later. (some items will be gone, removed by the tools, not to be concerned, just don't miss any) 6) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file) F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\xjvas.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ifdedae.exe O2 - BHO: (no name) - {24CDD264-853D-049B-DAFD-07894CF764E8} - C:\WINDOWS\Tknxcdpv.dll O2 - BHO: (no name) - {34B5AF39-C3A6-9C5F-0FB7-15DC4E3D8B7F} - C:\WINDOWS\ofgi.dll O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll O2 - BHO: KGhost - {968BC8A3-7660-4B12-B2BF-3334775835E1} - C:\Program Files\NetMeeting\KG\KGhost.dll O2 - BHO: (no name) - {D4887992-E30C-C38E-7550-EA5B542F6192} - C:\WINDOWS\system32\sfsdb.dll (file missing) O2 - BHO: (no name) - {D58879E3-E30E-CB86-7553-EE5B57296196} - C:\WINDOWS\system32\sfsdb.dll (file missing) O2 - BHO: (no name) - {D58879E5-E30C-C381-7526-E95B51286191} - C:\WINDOWS\system32\sfsdb.dll (file missing) O2 - BHO: (no name) - {DEB797C5-021A-4C2B-B490-F9B415179519} - C:\Program Files\Internet Explorer\pocevyhi.dll (file missing) G O2 - BHO: (no name) - {FBD2EBD0-E6DF-456E-B300-A4D10A90C683} - (no file) O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot O4 - HKLM\..\Run: [C:\WINDOWS\fewazsot.exe] C:\WINDOWS\fewazsot.exe O4 - HKLM\..\Run: [mszvdll] C:\WINDOWS\mszvdll.EXE O4 - HKLM\..\Run: [qccaenc] C:\WINDOWS\qccaenc.EXE O4 - HKLM\..\Run: [fdrpdll] C:\WINDOWS\fdrpdll.EXE O4 - HKLM\..\Run: [fdrpenc] C:\WINDOWS\fdrpenc.EXE O4 - HKLM\..\Run: [dhWin1.exe] dhWin1.exe O4 - HKLM\..\Run: [qjikdll] C:\WINDOWS\qjikdll.EXE O4 - HKLM\..\Run: [qjikenc] C:\WINDOWS\qjikenc.EXE O4 - HKLM\..\Run: [adstart] iexplore.exe http://__adstart O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe O15 - Trusted Zone: .adgate.info O15 - Trusted Zone: .dollarrevenue.com O15 - Trusted Zone: .elitemediagroup.net O15 - Trusted Zone: .errorsafe.com O15 - Trusted Zone: .imagesrvr.com O15 - Trusted Zone: .matcash.com O15 - Trusted Zone: .media-motor.com O15 - Trusted Zone: .mediatickets.net O15 - Trusted Zone: .snipernet.biz O15 - Trusted Zone: .snipernet.us O15 - Trusted Zone: .systemdoctor.com O15 - Trusted Zone: .winantivirus.com O15 - Trusted Zone: .winfixer.com O15 - Trusted Zone: .adgate.info (HKLM) O15 - Trusted Zone: .dollarrevenue.com (HKLM) O15 - Trusted Zone: .elitemediagroup.net (HKLM) O15 - Trusted Zone: .errorsafe.com (HKLM) O15 - Trusted Zone: .imagesrvr.com (HKLM) O15 - Trusted Zone: .matcash.com (HKLM) O15 - Trusted Zone: .media-motor.com (HKLM) O15 - Trusted Zone: .media-motor.net (HKLM) O15 - Trusted Zone: .mediatickets.net (HKLM) O15 - Trusted Zone: .snipernet.biz (HKLM) O15 - Trusted Zone: .snipernet.us (HKLM) O15 - Trusted Zone: .systemdoctor.com (HKLM) O15 - Trusted Zone: .winantivirus.com (HKLM) O15 - Trusted Zone: .winfixer.com (HKLM) O20 - AppInit_DLLs: iniwin32.dll,inicfg32.dll, O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll Close all programs but HJT and all browser windows, then click on "Fix Checked"* 7) RIGHT Click on Start then click on Explore. Locate and delete these items: (All files may not be there, just DO NOT miss any) C:\WINDOWS\fdrpdll.EXE C:\WINDOWS\fdrpenc.EXE C:\WINDOWS\fewazsot.exe C:\WINDOWS\mszvdll.EXE C:\WINDOWS\qccaenc.EXE C:\WINDOWS\qjikdll.EXE C:\WINDOWS\qjikenc.EXE C:\WINDOWS\system32\irssyncd.exe C:\WINDOWS\system32\ossproxy.exe 8) Run ATF Cleaner Double-click ATF-Cleaner.exe to run the program. Click Select All found at the bottom of the list. Click the Empty Selected button. Click Exit on the Main menu to close the program. 9) Restart the computer and post the report from E2TakeOut, C:\Qoofix\Qoofix Logfile.txt, a new HJT log and any comments you think will help. I will look at the information to see what is left to do as soon as possible after that. Thanks...pskelley Safer Networking Forums

2006-08-05, 19:36	#7
tashi Member of Team Spybot Join Date: Oct 2005 Location: USA Posts: 21,069 Rated LASSHes: 4	Hi, how is it going with that computer. __________________ UNITE-ASAP Microsoft MVP. Consumer Security 2006-2009 Please help us improve Spybot, download our distributed testing client

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

2006-07-26, 17:11	#4
thepicman Junior Member Join Date: Jul 2006 Location: Bottom of a Gin Bottle Posts: 28	Thanks! when installing the .inf file "windows cannot find grpconv" and everytime I right click, I get an install window saying "installing Defender Pro Anti Virus"? E2TakeOut v1.01 [http://www.malwarebytes.org] Removed! C:\WINDOWS\system32\inicfg32.dll Removed! C:\WINDOWS\system32\iniwin32.dll Removed directory and files! C:\Program Files\E2G Removed orphaned leftovers AppInit key reset Qoofix v1.02 by http://www.malwarebytes.org Scan started on [7/26/2006] at [8:27:46 AM] ------------------------------------------------------------- Terminated module: nhevjdp.dll found in Qoofix.exe (3884) Terminated module: nhevjdp.dll found in hafvsu.exe (2672) Terminated module: nhevjdp.dll found in explorer.exe (2736) Terminated module: nhevjdp.dll found in xjvas.exe (2816) Terminated module: nhevjdp.dll found in xjvas.exe (2848) Terminated module: nhevjdp.dll found in xjvas.exe (2856) Terminated module: nhevjdp.dll found in hphmon05.exe (3144) Terminated module: nhevjdp.dll found in HpqCmon.exe (3212) ------------------------------------------------------------- C:\WINDOWS\system32\hafvsu.exe will be deleted on reboot! C:\WINDOWS\system32\ifdedae.exe will be deleted on reboot! C:\WINDOWS\system32\mxtye.dat will be deleted on reboot! C:\WINDOWS\system32\nhevjdp.dll will be deleted on reboot! C:\WINDOWS\system32\xjvas.exe will be deleted on reboot! C:\Documents and Settings\All Users\Start Menu\Programs\Startup\yhqwy.exe will be deleted on reboot! User prompted YES to reboot, system now rebooting... ------------------------------------------------------------- Scan COMPLETED SUCCESSFULLY on [7/26/2006] at [8:29:30 AM] Note: Some registry keys may have been removed. Logfile of HijackThis v1.99.1 Scan saved at 9:00:39 AM, on 7/26/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\MsiExec.exe C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe C:\WINDOWS\system32\MsiExec.exe C:\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...4/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1092959613625 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

2006-07-31, 17:48	#6
thepicman Junior Member Join Date: Jul 2006 Location: Bottom of a Gin Bottle Posts: 28	Phil, thanks for the help. Was OOT for a few days, will finish up and get back to you. TPM

2006-08-06, 02:34	#9
pskelley In Memoriam -Always in our heart Join Date: Oct 2005 Location: Clearwater, Florida Posts: 20,559	Am I blind? Is there no active antivirus program running on this computer Online scans will just not protect you. Here are some free ones and I suggest AVG by Grisoft: http://free.grisoft.com/freeweb.php http://www.avast.com/eng/avast_4_home.html http://www.free-av.com/ The HJT log appears clean of malware, here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online: http://forums.spybot.info/showthread.php?t=279 http://russelltexas.com/malware/allclear.htm http://forum.malwareremoval.com/viewtopic.php?t=14 http://www.bleepingcomputer.com/forums/topict2520.html http://cybercoyote.org/security/not-admin.shtml System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on: http://service1.symantec.com/SUPPORT...rc=sec_doc_nam Safe surfing...tashi will close the topic in a day or so. Thanks...pskelley Safer Networking Forums http://www.spybot.info/en/donate/index.html If you are reading this information...thank a teacher, If you are reading it in English...thank a soldier.