Hijack this log (WXP-Home)

[tieren]

Hi guys, i just reformated my com and there's a host of viruses in it now. heres my hijackthis log, please check it. Thanks


Logfile of HijackThis v1.97.7
Scan saved at 4:43:42 PM, on 10/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pksvc.exe
C:\WINDOWS\System32\xpndis.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\spoolsv32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\bet.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\WinBar\WinBar.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Opera75\opera.exe
D:\_Zipped\essentials\HijackThis.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [Microsoft Server Applacations] visual.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] sys.exe
O4 - HKLM\..\Run: [LOLss] wssdsfgsd.exe
O4 - HKLM\..\Run: [PK Services] pksvc.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\rdwpreop.exe
O4 - HKLM\..\Run: [scvhost] spoolsv32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\Run: [blah services] bet.exe
O4 - HKLM\..\Run: [Microsoft AutoUpdater] svhost.exe
O4 - HKLM\..\Run: [CRC Value Verifier] crsss64.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PowerMenu] "%systemroot%\system32\powermenu.exe" -hideself on
O4 - HKLM\..\RunServices: [Microsoft Server Applacations] visual.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] sys.exe
O4 - HKLM\..\RunServices: [LOLss] wssdsfgsd.exe
O4 - HKLM\..\RunServices: [PK Services] pksvc.exe
O4 - HKLM\..\RunServices: [scvhost] spoolsv32.exe
O4 - HKLM\..\RunServices: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\RunServices: [blah services] bet.exe
O4 - HKLM\..\RunServices: [Microsoft AutoUpdater] svhost.exe
O4 - HKLM\..\RunServices: [CRC Value Verifier] crsss64.exe
O4 - HKCU\..\Run: [LOLss] wssdsfgsd.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] sys.exe
O4 - HKCU\..\Run: [Microsoft Server Applacations] visual.exe
O4 - HKCU\..\Run: [PK Services] pksvc.exe
O4 - HKCU\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\Run: [Microsoft AutoUpdater] svhost.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\RunOnce: [PK Services] pksvc.exe
O4 - HKLM\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\RunOnce: [PK Services] pksvc.exe
O4 - HKCU\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - Startup: WinBar.lnk = C:\Program Files\WinBar\WinBar.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{C84C0A5A-9F6B-45B2-9DAE-69B7340DBD8C}: NameServer = 165.21.100.88 165.21.83.88

[monkey_1]

-Disable system restore, update your antivirus and do a full system scan starting in Safe mode
-Download, install, update and run both Spybot S&D and Adaware
-Update the version of HijackThis and run it and post the Logfile

<font color=orange>Mono</font color=orange>

[tieren]

Alright, I ran norton, spybot and adaware. heres my log and please check it. Thanks.

Logfile of HijackThis v1.97.7
Scan saved at 1:15:42 PM, on 10/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\xpndis.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\CyberLat\CyberLat RAM Cleaner 2,0\CLRamCleaner.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinBar\WinBar.exe
C:\Program Files\Opera75\opera.exe
C:\Program Files\Winamp\Winamp.exe
C:\Program Files\Hijack This!\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [Microsoft Server Applacations] visual.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\rdwpreop.exe
O4 - HKLM\..\Run: [scvhost] spoolsv32.exe
O4 - HKLM\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\Run: [CRC Value Verifier] crsss64.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CyberLat Ram Cleaner] C:\Program Files\CyberLat\CyberLat RAM Cleaner 2,0\CLRamCleaner.exe
O4 - HKLM\..\Run: [NDIS TCP AUTO] xpnis.exe
O4 - HKLM\..\Run: [SystemMgr] C:\WINDOWS\system32\b0t\loader.exe
O4 - HKLM\..\RunServices: [Microsoft Server Applacations] visual.exe
O4 - HKLM\..\RunServices: [scvhost] spoolsv32.exe
O4 - HKLM\..\RunServices: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\RunServices: [CRC Value Verifier] crsss64.exe
O4 - HKLM\..\RunServices: [NDIS TCP AUTO] xpnis.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] sys.exe
O4 - HKCU\..\Run: [Microsoft Server Applacations] visual.exe
O4 - HKCU\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NDIS TCP AUTO] xpnis.exe
O4 - HKLM\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - Startup: Shortcut to DSL500U ADSL USB Modem dial-up.lnk = ?
O4 - Startup: WinBar.lnk = C:\Program Files\WinBar\WinBar.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C84C0A5A-9F6B-45B2-9DAE-69B7340DBD8C}: NameServer = 165.21.100.88 165.21.83.88

[monkey_1]

In HijackThis (make sure it is configured to make backups--&gt;"Config button"--&gt;"Main" button), check to fix the next entries:

O4 - HKLM\..\Run: [Microsoft Server Applacations] visual.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\rdwpreop.exe
O4 - HKLM\..\Run: [scvhost] spoolsv32.exe
O4 - HKLM\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\Run: [CRC Value Verifier] crsss64.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NDIS TCP AUTO] xpnis.exe
O4 - HKLM\..\Run: [SystemMgr] C:\WINDOWS\system32\b0t\loader.exe
O4 - HKLM\..\RunServices: [Microsoft Server Applacations] visual.exe
O4 - HKLM\..\RunServices: [scvhost] spoolsv32.exe
O4 - HKLM\..\RunServices: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\RunServices: [CRC Value Verifier] crsss64.exe
O4 - HKLM\..\RunServices: [NDIS TCP AUTO] xpnis.exe
O4 - HKCU\..\Run: [Microsoft Server Applacations] visual.exe
O4 - HKCU\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\Run: [NDIS TCP AUTO] xpnis.exe
O4 - HKLM\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - Startup: WinBar.lnk = C:\Program Files\WinBar\WinBar.exe

Reboot, test your machine and run HJT again and post the logfile...

<font color=orange>Mono</font color=orange>