Re: HijackThisLog Analysis - Alex

Date: Friday, 17 September, 2004 12:43 PM

Peter, you helped me out once b4,wondering if you could look at this for me thank you. Alex

Reply:

Alex, remember not to run hijackthis.exe inside the zip file.  Unzip (extract) it to your desktop then double click on "HijackThis.exe" icon in this way a backup for the removed key will be created on your desktop (useful if you remove them wrongly).

Ok, this is what you should do.

End the below suspicious process :

C: \ WINDOWS \ system32 \ apixy32.exe
C: \ Program Files \ ISTsvc \ istsvc.exe
C: \ Program Files \ Winad Client \ Winad.exe
C: \ WINDOWS \ System32 \ pflkkjm.exe
C: \ Program Files \ Winad Client \ WinClt.exe
C: \ Documents and Settings \ AlexK \ Application Data \ kbur?.exe
C: \ WINDOWS \ System32 \ DVDRAMSV.exe
C: \ WINDOWS \ apizh32.exe

O2 - BHO: (no name) - {2B33EA89-1D32-F522-553E-7D97ADB095BC} - C: \ WINDOWS \ netyo.dll
O2 - BHO: (no name) - {3418E16A-D23F-0B48-A116-E32D7DFBE10D} - C: \ WINDOWS \ system32 \ addsy.dll

O4 - HKLM \ .. \ Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM \ .. \ Run: [apixy32.exe] C: \ WINDOWS \ system32 \ apixy32.exe
O4 - HKLM \ .. \ Run: [IST Service] C: \ Program Files \ ISTsvc \ istsvc.exe
O4 - HKLM \ .. \ Run: [Internet Optimizer] "C: \ Program Files \ Internet Optimizer \ optimize.exe"
O4 - HKLM \ .. \ Run: [Winad Client] C: \ Program Files \ Winad Client \ Winad.exe
O4 - HKLM \ .. \ Run: [zjsuvi] C: \ WINDOWS \ System32 \ pflkkjm.exe
O4 - HKLM \ .. \ Run: [explorer] C: \ WINDOWS \ system32 \ explorer.exe -go -c6 -w

O4 - HKCU \ .. \ Run: [Osus] C: \ Documents and Settings \ AlexK \ Application Data \ kbur?.exe

O4 - Global Startup: RAMASST.lnk = C: \ WINDOWS \ system32 \ RAMASST.exe

Remove these extra items in IE menu (O8...O9):

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C: \ WINDOWS \ web \ related.htm
O9 - Extra ´Tools´ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C: \ WINDOWS \ web \ related.htm

Remove this trusted? zones:

O15 - Trusted Zone: *.searchmiracle.com

Remove these ActiveX Objects (aka Downloaded Program Files) if you are not using them (O16):

O16 - DPF: {10000000-1000-0000-1000-000000000000} - file: / / C: \ Program Files \ Internet Explorer \ usmtxwvv.exe
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file: / / c: \ explorer.cab

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - website: public.windupdates.com / get_file.php?bt=ie&p=9eafa ... be1d6
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - website: xxxtoolbar.com / ist / softwares / v4.0 / 0006_regular.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - website: webcamnow.com / broadcast / ActiveXWebCam.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - website: mt-download.com / MediaTicketsInstaller.cab

Remove these extra protocols:

O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C: \ WINDOWS \ msopt.dll (file missing)

Logfile of HijackThis v1.98.2
Scan saved at 2:43:34 PM, on 9 / 17 / 2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ System32 \ Ati2evxx.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ system32 \ spoolsv.exe
C: \ WINDOWS \ Explorer.EXE
C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe
C: \ Program Files \ TOSHIBA \ E-KEY \ CeEKey.exe
C: \ Program Files \ TOSHIBA \ Power Management \ CePMTray.exe
C: \ Program Files \ EzButton \ EzButton.EXE
C: \ Program Files \ TOSHIBA \ TouchPad \ TPTray.exe
C: \ Program Files \ TOSHIBA \ ConfigFree \ NDSTray.exe
C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
C: \ Program Files \ TOSHIBA \ Touch and Launch \ PadExe.exe
C: \ WINDOWS \ AGRSMMSG.exe
C: \ Program Files \ Microsoft IntelliType Pro \ type32.exe
C: \ Program Files \ Microsoft IntelliPoint \ point32.exe
C: \ PROGRA~1 \ mcafee.com \ vso \ mcvsshld.exe
C: \ PROGRA~1 \ mcafee.com \ agent \ mcagent.exe
C: \ PROGRA~1 \ mcafee.com \ vso \ mcvsescn.exe
C: \ WINDOWS \ system32 \ apixy32.exe
C: \ Program Files \ ISTsvc \ istsvc.exe
C: \ Program Files \ Winad Client \ Winad.exe
C: \ WINDOWS \ System32 \ pflkkjm.exe
C: \ WINDOWS \ system32 \ explorer.exe
C: \ Program Files \ Winad Client \ WinClt.exe
C: \ Program Files \ TOSHIBA \ TOSCDSPD \ toscdspd.exe
C: \ WINDOWS \ System32 \ ctfmon.exe
C: \ Program Files \ Messenger \ msmsgs.exe
C: \ Documents and Settings \ AlexK \ Application Data \ kbur?.exe
C: \ Program Files \ Adobe \ Acrobat 5.0 \ Distillr \ AcroTray.exe
C: \ Program Files \ Microsoft Office \ OFFICE11 \ ONENOTEM.EXE
C: \ WINDOWS \ system32 \ RAMASST.exe
c: \ progra~1 \ mcafee.com \ vso \ mcvsftsn.exe
C: \ Program Files \ TOSHIBA \ Power Management \ CeEPwrSvc.exe
C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe
C: \ WINDOWS \ System32 \ DVDRAMSV.exe
c: \ PROGRA~1 \ mcafee.com \ vso \ mcvsrte.exe
C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE
C: \ WINDOWS \ apizh32.exe
C: \ PROGRA~1 \ Telstra \ TELSTR~1 \ app \ pppoeservice.exe
C: \ WINDOWS \ System32 \ svchost.exe
c: \ PROGRA~1 \ mcafee.com \ vso \ mcshield.exe
C: \ WINDOWS \ System32 \ wuauclt.exe
C: \ Documents and Settings \ AlexK \ Local Settings \ Temp \ Temporary Directory 1 for 1188084.zip \ HijackThis.exe
C: \ Program Files \ Internet Explorer \ iexplore.exe
C: \ Program Files \ Internet Explorer \ iexplore.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C: \ Program Files \ Adobe \ Acrobat 5.0 \ Acrobat \ ActiveX \ AcroIEHelper.ocx
O2 - BHO: (no name) - {2B33EA89-1D32-F522-553E-7D97ADB095BC} - C: \ WINDOWS \ netyo.dll
O2 - BHO: (no name) - {3418E16A-D23F-0B48-A116-E32D7DFBE10D} - C: \ WINDOWS \ system32 \ addsy.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C: \ WINDOWS \ System32 \ msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c: \ progra~1 \ mcafee.com \ vso \ mcvsshl.dll
O4 - HKLM \ .. \ Run: [ATIPTA] C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe
O4 - HKLM \ .. \ Run: [CeEKEY] C: \ Program Files \ TOSHIBA \ E-KEY \ CeEKey.exe
O4 - HKLM \ .. \ Run: [CeEPOWER] C: \ Program Files \ TOSHIBA \ Power Management \ CePMTray.exe
O4 - HKLM \ .. \ Run: [EzButton] C: \ Program Files \ EzButton \ EzButton.EXE
O4 - HKLM \ .. \ Run: [Apoint] C: \ Program Files \ Apoint2K \ Apoint.exe
O4 - HKLM \ .. \ Run: [TPNF] C: \ Program Files \ TOSHIBA \ TouchPad \ TPTray.exe
O4 - HKLM \ .. \ Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
O4 - HKLM \ .. \ Run: [PadTouch] C: \ Program Files \ TOSHIBA \ Touch and Launch \ PadExe.exe
O4 - HKLM \ .. \ Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM \ .. \ Run: [type32] "C: \ Program Files \ Microsoft IntelliType Pro \ type32.exe"
O4 - HKLM \ .. \ Run: [IntelliPoint] "C: \ Program Files \ Microsoft IntelliPoint \ point32.exe"
O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ WINDOWS \ system32 \ NeroCheck.exe
O4 - HKLM \ .. \ Run: [VSOCheckTask] "c: \ PROGRA~1 \ mcafee.com \ vso \ mcmnhdlr.exe" / checktask
O4 - HKLM \ .. \ Run: [VirusScan Online] "c: \ PROGRA~1 \ mcafee.com \ vso \ mcvsshld.exe"
O4 - HKLM \ .. \ Run: [MCAgentExe] c: \ PROGRA~1 \ mcafee.com \ agent \ mcagent.exe
O4 - HKLM \ .. \ Run: [MCUpdateExe] C: \ PROGRA~1 \ mcafee.com \ agent \ mcupdate.exe
O4 - HKLM \ .. \ Run: [apixy32.exe] C: \ WINDOWS \ system32 \ apixy32.exe
O4 - HKLM \ .. \ Run: [IST Service] C: \ Program Files \ ISTsvc \ istsvc.exe
O4 - HKLM \ .. \ Run: [Internet Optimizer] "C: \ Program Files \ Internet Optimizer \ optimize.exe"
O4 - HKLM \ .. \ Run: [Winad Client] C: \ Program Files \ Winad Client \ Winad.exe
O4 - HKLM \ .. \ Run: [zjsuvi] C: \ WINDOWS \ System32 \ pflkkjm.exe
O4 - HKLM \ .. \ Run: [explorer] C: \ WINDOWS \ system32 \ explorer.exe -go -c6 -w
O4 - HKCU \ .. \ Run: [TOSCDSPD] C: \ Program Files \ TOSHIBA \ TOSCDSPD \ toscdspd.exe
O4 - HKCU \ .. \ Run: [ctfmon.exe] C: \ WINDOWS \ System32 \ ctfmon.exe
O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / background
O4 - HKCU \ .. \ Run: [Osus] C: \ Documents and Settings \ AlexK \ Application Data \ kbur?.exe
O4 - Global Startup: Acrobat Assistant.lnk = C: \ Program Files \ Adobe \ Acrobat 5.0 \ Distillr \ AcroTray.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C: \ Program Files \ Microsoft Office \ OFFICE11 \ ONENOTEM.EXE
O4 - Global Startup: RAMASST.lnk = C: \ WINDOWS \ system32 \ RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res: / / C: \ PROGRA~1 \ MICROS~2 \ OFFICE11 \ EXCEL.EXE / 3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra ´Tools´ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C: \ PROGRA~1 \ MICROS~2 \ OFFICE11 \ REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C: \ WINDOWS \ web \ related.htm
O9 - Extra ´Tools´ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C: \ WINDOWS \ web \ related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C: \ Program Files \ Messenger \ MSMSGS.EXE
O9 - Extra ´Tools´ menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C: \ Program Files \ Messenger \ MSMSGS.EXE
O12 - Plugin for .spop: C: \ Program Files \ Internet Explorer \ Plugins \ NPDocBox.dll
O15 - Trusted Zone: *.searchmiracle.com
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file: / / C: \ Program Files \ Internet Explorer \ usmtxwvv.exe
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file: / / c: \ explorer.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - website: public.windupdates.com / get_file.php?bt=ie&p=9eafa ... be1d6
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - website: xxxtoolbar.com / ist / softwares / v4.0 / 0006_regular.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - website: bin.mcafee.com / molbin / shared / mcinsctl / en-au / 4,0,0,83 / mcinsctl.cab
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - website: webcamnow.com / broadcast / ActiveXWebCam.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - website: mt-download.com / MediaTicketsInstaller.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - website: bin.mcafee.com / molbin / shared / mcgdmgr / en-au / 1,0,0,20 / mcgdmgr.cab
O17 - HKLM \ System \ CCS \ Services \ Tcpip \ .. \ {EC68B785-BCBA-47B6-87F4-FF1EC9DE1DEB}: NameServer = 61.9.128.14 61.9.128.15
O17 - HKLM \ System \ CS1 \ Services \ Tcpip \ Parameters: SearchList = vic.bigpond.net.au
O17 - HKLM \ System \ CCS \ Services \ Tcpip \ Parameters: SearchList = vic.bigpond.net.au
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C: \ WINDOWS \ msopt.dll (file missing)