elite.elitum, sm.exe, etc etc etc

[linet]

Hi people,

desperately need some help here. My computer is just infested with spywares!!! I tried spybot, spyblaster, adaware, pchousecall.... everything i know....

there is this thing called elite.elitum that keeps recurring whenever i try to fix the problem with spybot. At the same time, everytime after i go online and i run the adaware again, there is bound to be some new "problems" it has found.

i also just noticed that on my C drive there are a lot of weird files like dddd.exe, eree.exe, sm.exe etc. Are these things needed or can i delete them??

I would be grateful if someone can tell me what i can do.
( i am quite a computer idiot in case you want to know so please try to be as explicit in your instructions as can be...)

Thank you so MUCH.

info is below.

Logfile of HijackThis v1.98.2
Scan saved at 5:35:30 AM, on 2/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\csrss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\ctfmon.exe
C:\dddd.exe
C:\WINXP\System32\rundll32.exe
C:\dddd.exe
C:\WINXP\explorer.exe
c:\winxp\system32\zcsdpj.exe
c:\winxp\system32\packager.exe
C:\Program Files\Common Files\System\MAPI\1033\dddd.exe
C:\WINXP\System32\Regsvr32.exe
C:\sm.exe
C:\dddd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Hui Min\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINXP\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=C:\WINXP\System32\soft.exe
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINXP\ZServ.dll
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINXP\EliteToolBar\EliteToolBar version 59.dll
O2 - BHO: (no name) - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINXP\System32\wnim.dll
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINXP\EliteSideBar\EliteSideBar 08.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINXP\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [NECMFK] C:\Program Files\necmfk\necmfk.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINXP\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINXP\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LoadMSvcmm] C:\WINXP\System32\msvcmm32.exe
O4 - HKLM\..\Run: [appfm.exe] C:\WINXP\system32\appfm.exe
O4 - HKLM\..\Run: [D7.tmp] C:\DOCUME~1\HUIMIN~1\LOCALS~1\Temp\D7.tmp.exe 1 10001
O4 - HKLM\..\Run: [tibs5] C:\WINXP\System32\tibs5.exe
O4 - HKLM\..\Run: [Web Service] C:\WINXP\System32\sm.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINXP\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINXP\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [zcsdpj] c:\winxp\system32\zcsdpj.exe
O4 - HKLM\..\Run: [njmV] C:\WINXP\etgvscm.exe
O4 - HKLM\..\Run: [ot7O36V] aaaads.exe
O4 - HKLM\..\Run: [D7.tmp.exe] C:\DOCUME~1\HUIMIN~1\LOCALS~1\Temp\D7.tmp.exe 1 10001
O4 - HKLM\..\Run: [kalvsys] c:\winxp\system32\kalvkef32.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe wnim.dll, DllRegisterServer
O4 - HKLM\..\RunOnce: [ICDRegOCX0] rundll32.exe advpack.dll,RegisterOCX C:\WINXP\Downloaded Program Files\CONFLICT.2\v3.dll
O4 - HKLM\..\RunOnce: [ICDRegOCX1] rundll32.exe advpack.dll,RegisterOCX C:\WINXP\Downloaded Program Files\CONFLICT.2\loader2.ocx
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKLM\..\RunOnce: [ICDRegOCX2] rundll32.exe advpack.dll,RegisterOCX C:\WINXP\Downloaded Program Files\loader2.ocx
O4 - HKLM\..\RunOnce: [ICDRegOCX3] rundll32.exe advpack.dll,RegisterOCX C:\WINXP\Downloaded Program Files\CONFLICT.3\v3.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Web Service] C:\WINXP\System32\sm.exe
O4 - HKCU\..\Run: [ZAoERWZme] xacmac.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Short Message - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_taijilian_48651 (file missing)
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2****ed.biz
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.ysbweb.com
O16 - DPF: v3cab - http://searchmiracle.com/cab/10.cab
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098211954327
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINXP\System32\wnim.dll
O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINXP\System32\wnim.dll

[nightowl]

Do you have any AntiVirus on here?


http://forums.designtechnica.com/showthread.php?t=5583

Download AVG AntiVirus, ADaware, Spybot ,Microsoft AntiSpyware. Links Above

On AVG AntiVirus, Let it scan, delete or quarantine what it finds,

On the other 3 programs , let them scan(one at a time) delete what they find. Delete Temporary Internet Files, Cookies, Empty Recycle Bin, Reboot and Post a new log.

[linet]

hey there,

Really grateful for your reply. I have followed all the instructions but no use.

SOme other problems now:
(i) when i was running spybot after i have already done the AVG virus, there were still pop ups from AVG virus saying that there are Trojan :Dialer in my computer, and many other forms of the Trojan.

(ii) When i restart my computer, there is a pop up right at the start that says "error loading wnim.dll"

(iii) when i start internet, there is a pop up that says "sspmydoom.cih version 2018 is trying to spy my computer through some port... " something along such lines.

(iv) me and my housemate tried to prevent certain files from starting up eg C:\Winxp\system32\tibs.exe After i rebooted and before i scanned the computer using the above programs, i tracked down some of the files and had them deleted. BUT now they are again up and running!!!

Anyway... here is my new log. PLEASE help..... desperately in need of computer for my exams this week!!!



Logfile of HijackThis v1.98.2
Scan saved at 2:20:31 PM, on 2/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\System32\atievxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\necmfk\necmfk.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINXP\System32\msvcmm32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINXP\system32\appfm.exe
C:\WINXP\System32\Lbptjg.exe
C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINXP\System32\Zltcig.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\etgvscm.exe
C:\WINXP\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINXP\System32\xacmac.exe
C:\WINXP\system32\sdkmi.exe
C:\WINXP\System32\wuauclt.exe
C:\Documents and Settings\Hui Min\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINXP\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {38A16FB6-C2D6-4EEA-A705-D170292B04EC} - C:\WINXP\javawj.dll
O4 - HKLM\..\Run: [NECMFK] C:\Program Files\necmfk\necmfk.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINXP\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINXP\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LoadMSvcmm] C:\WINXP\System32\msvcmm32.exe
O4 - HKLM\..\Run: [appfm.exe] C:\WINXP\system32\appfm.exe
O4 - HKLM\..\Run: [zcsdpj] c:\winxp\system32\zcsdpj.exe
O4 - HKLM\..\Run: [version] C:\WINXP\System32\Lbptjg.exe
O4 - HKLM\..\Run: [secure] C:\WINXP\System32\Zltcig.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [kalvsys] C:\winxp\system32\kalvhlu32.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe wnim.dll, DllRegisterServer
O4 - HKLM\..\Run: [oxkrcj] C:\oxkrcj.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [nq2sLgs58] C:\WINXP\etgvscm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ZAoERWZme] xacmac.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Short Message - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_taijilian_48651 (file missing)
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2****ed.biz
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098211954327
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - (no file)

[nightowl]

C:\sm.exe
C:\dddd.exe

these are gone, thats good, i'll take a look check back in 30 minutes.........Jim

[nightowl]

O4 - HKLM\..\Run: [kalvsys] C:\winxp\system32\kalvhlu32.exe

Need to Kill this first, heres how.

Go to Safe Mode (F8 on startup)
You need to do a search on your computer and look for any files where the first 4 letters begin with KALV

kalvhlu32.exe

there may be several on your computer.

When you find these files you need to rename them. You need to remove the exe and replace it with the name old so the file looks like this

kalvhlu32.old

(The Files may not have hlu They can be any 3 letters but the first 4 letters are always KALV)

If it works, you can go back to safe mode, and search "*.OLD" And delete those files. Empty Recycle Bin.

Reboot and post a new log.

[nightowl]

After You rename the Kalv Files This is the next step.



Reboot To Safe Mode (tap F8 on Startup)

Delete these Files and or Folders

C:\WINXP\system32\appfm.exe
C:\WINXP\System32\Lbptjg.exe
C:\WINXP\System32\Zltcig.exe
C:\WINXP\etgvscm.exe
C:\WINXP\System32\xacmac.exe
C:\WINXP\system32\sdkmi.exe


Still In Safe Mode Place a check next to each of these and click Fix Checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINXP\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {38A16FB6-C2D6-4EEA-A705-D170292B04EC} - C:\WINXP\javawj.dll
O4 - HKLM\..\Run: [appfm.exe] C:\WINXP\system32\appfm.exe
O4 - HKLM\..\Run: [zcsdpj] c:\winxp\system32\zcsdpj.exe
O4 - HKLM\..\Run: [version] C:\WINXP\System32\Lbptjg.exe
O4 - HKLM\..\Run: [secure] C:\WINXP\System32\Zltcig.exe
O4 - HKLM\..\Run: [kalvsys] C:\winxp\system32\kalvhlu32.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe wnim.dll, DllRegisterServer
O4 - HKLM\..\Run: [oxkrcj] C:\oxkrcj.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [nq2sLgs58] C:\WINXP\etgvscm.exe
O4 - HKCU\..\Run: [ZAoERWZme] xacmac.exe
O9 - Extra button: Short Message - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_taijilian_48651 (file missing)
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messeng...nger.yahoo.com/ (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2****ed.biz
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - (no file)

Still In Safe Mode Delete all Temporary Internet Files, Cookies, Do a Defrag on your C Drive, Empty recycle bin.

Start/All Programs/Accessories/System Tools/Disc Defragment

Then Reboot and post a new log..........Jim
:eww

[linet]

Dear Saviour JIm,

NO POPUPS SO FAR!!!! Hooray!!!

BUT.... slight probs though.....
(i) when i had the computer rebooted as per normal, there was a dialog box saying that "c:\WINXP\system32\sdkmi.exe is not available"
Is there something wrong?

(ii) As mentioned previously, me and housemate tried to solve the prob initially by unchecking certain startup processes in msconfig eg. D7, aaads.exe, sm.exe, ffisearch.exe, tibs.exe, desktop.exe, sais.exe and Rundll32.exe.
Now everytime when i start up, the dialog box would come up saying that i have chosen to start up using personal setting (something like that... sorry... can't remember..)

Can i just ignore it? or do the existence of these files in my msconfig pose any further threats?

there is still this weird xxxtoolbar thing... what is that?

DO let me know. =) Thank you so so much!!

The new log is here.

Logfile of HijackThis v1.98.2
Scan saved at 5:58:09 PM, on 2/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\System32\atievxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\wuauclt.exe
C:\Program Files\necmfk\necmfk.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINXP\System32\msvcmm32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINXP\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
C:\Documents and Settings\Hui Min\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
O4 - HKLM\..\Run: [NECMFK] C:\Program Files\necmfk\necmfk.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINXP\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINXP\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LoadMSvcmm] C:\WINXP\System32\msvcmm32.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098211954327
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab

[linet]

popups coming again....

And spybot just keeps popping up non stop saying that it detected registry changes..... i just basically chose to deny all changes... as i have no idea what it is about....


And symantec caught yet another bloodhound?

Weird icons keeps coming o the desktop... eg... platinum visa and various spyware products....

Oh and there is this new bankup folder on the desktop... do i need it??

What to do??

[nightowl]

You had alot of Spyware on here. It looks better, Some things reloaded. Which happens alot. I wish these things would go away on the first try but that doesnt happen. Let me check it again.


Reboot To Safe Mode (tap F8 on Startup)

Still In Safe Mode Place a check next to each of these and click Fix Checked.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINXP\system32\qmpaz.dll/sp.html#12345
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com

Still In Safe Mode Delete all Temporary Internet Files, Cookies, Empty Recycle Bin
Then Reboot and post a new log..........Jim

[nightowl]

Delete any wierd icons and folders also. Put them in the Recycle Bin and delete with the rest.

If you did not put them there They are Bad.......Jim

[linet]

Thank you so much for the help.

Just did the check again and below is the new log

Oh... there is this little tool bar thing that keeps appearing on the bottom right of my desktop. I have no idea what program is that... how can i check it? I was hoping to just delete whatever folder it might have come from, but has absolutely no idea how to check for its name.... no properties .. nothing when i right click on it.


Logfile of HijackThis v1.98.2
Scan saved at 9:37:29 PM, on 2/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\System32\atievxx.exe
C:\Program Files\necmfk\necmfk.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINXP\System32\msvcmm32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINXP\isrvs\desktop.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\winxp\system32\zcsdpj.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINXP\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\winxp\system32\packager.exe
C:\WINXP\System32\svchost.exe
C:\Documents and Settings\Hui Min\Desktop\HijackThis.exe
C:\WINXP\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINXP\System32\boln.dll
O4 - HKLM\..\Run: [NECMFK] C:\Program Files\necmfk\necmfk.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINXP\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINXP\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LoadMSvcmm] C:\WINXP\System32\msvcmm32.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINXP\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINXP\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM\..\Run: [zcsdpj] c:\winxp\system32\zcsdpj.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098211954327
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINXP\isrvs\mfiltis.dll

[nightowl]

Looks Like you have ISearch now too.

Reboot to Safe Mode again

Delete these files and or Folders

C:\WINXP\isrvs\desktop.exe
C:\winxp\system32\zcsdpj.exe

Follow the link on this one.
C:\winxp\system32\packager.exe
special instructions here

http://www.symantec.com/avcenter/venc/data/backdoor.smorph.html

C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
I have no clue what this is, May be bad. ????

Still In Safe Mode Place a check next to each of these and click Fix Checked.

O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINXP\System32\boln.dll
O4 - HKLM\..\Run: [Desktop Search] C:\WINXP\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINXP\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM\..\Run: [zcsdpj] c:\winxp\system32\zcsdpj.exe
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.windupdates.com
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINXP\isrvs\mfiltis.dll

Empty Recycle Bin, Reboot and Post a new log.


Make sure you follow the special instructions on that link. :eww

[linet]

Hey there,

I have followed faithfully ALL instructions EXCEPT the one about symantec. That is because for some weird reasons, i cannot even access the symantec page.

My housemate gave it a try but she said the symantec homepage works one her computer... but somehow on mine it just says server not found. I tried the swedish symantec website, that can be opened... but not the Uk nor US one.

Is there something terribly wrong??

Another thing.... i have no idea where to find that movie~1\.exe file....... cannot find it anywhere.... tried to use search.... but nothing came out of it.... is it just me? I went to C drive... but in the first place found no folder nor file with the name PROGRA~1.....

Sigh... this is driving me nuts.........

anyway... here is the log:

Logfile of HijackThis v1.98.2
Scan saved at 11:12:39 PM, on 2/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\System32\atievxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\necmfk\necmfk.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINXP\System32\msvcmm32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINXP\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~1.EXE
C:\WINXP\System32\svchost.exe
C:\Documents and Settings\Hui Min\Desktop\HijackThis.exe
C:\WINXP\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O4 - HKLM\..\Run: [NECMFK] C:\Program Files\necmfk\necmfk.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINXP\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINXP\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINXP\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LoadMSvcmm] C:\WINXP\System32\msvcmm32.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098211954327
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab

[linet]

all the irritating popups are coming again!!!

everytime after i do what you tell me to, i do get a short period of peace... THEN... things will all come back.. most files deleted will come back....

Sigh... so i thought i would want to describe to you what will happen after my short period of peace....

There will always be this command prompt window that pops up real fast.... (but i can't see anything in it... might be because is really just flashes really quickly)

Following that.... a downloading dialogue box will open.... downloading something.... called... felkng.ini..... (sorry... but similarly.... this dialog box flashes so quickly that i barely see anything and it is already done)

After that..... spy bot will start popping up pointing out that some process is trying to make registry changes .. eg. category ICDRegOCXO, new data: rundll32.exe advpackdll, RegisterOCX etc etc.

OH... and there will be this stupid porn site that comes up and says that it is trying to dial some modem but modem not found....

THEN dear symantec will come in to say that bloodhound32 is caught.

Is this how things are supposed to be? or did i do something wrong???

sorry to keep bugging.... but sigh..... you should understand how i feel... argh.

[nightowl]

Your computer has a trojan or several of them. I copied and pasted the link that you could not open........Jim


Backdoor.Smorph


Backdoor.Smorph is a polymorphic Trojan horse. It is distributed as an executable that is embedded inside of an .shs file. The Trojan drops files and opens network connections.

NOTE: An .shs file is a Microsoft Scrap Object file. These files are executable and can contain a wide variety of objects. The scrap object (.shs) extension does not appear in Windows Explorer even if all file extensions are displayed.




Type: Trojan Horse
Infection Length: 327,168 bytes











Virus Definitions (Intelligent Updater) *
October 16, 2000


*
Intelligent Updater definitions are released daily, but require manual download and installation.
Click here to download manually.

**
LiveUpdate virus definitions are usually released every Wednesday.
Click here for instructions on using LiveUpdate.







Wild:

Number of infections: 0 - 49
Number of sites: 0 - 2
Geographical distribution: Low
Threat containment: Easy
Removal: Moderate
Threat Metrics


Wild:
Low
Damage:
Low
Distribution:
Low



Damage

Payload: Opens network connection.
Distribution

Ports: 23276, 23477


Backdoor.Smorph is distributed as an .shs file (OLE container) containing an executable. The .shs file type is launched in the same manner as an .exe file. The embedded executable runs as soon as the .shs file is launched.

The Trojan horse infects the system in the following manner:

When activated, the .shs file launches Packager.exe, a Windows utility, and commands it to create Pkg4135.exe in the Temp folder and run it.
Pkg4135.exe creates Vmldr.vxd, Jpegcomp.dll, and Oleproc.exe in the \System folder.
After the file creation, Oleproc.exe launches.
Pkg4135.exe then creates the Windows registry key HKEY_LOCAL_MACHINE\CurrentControlSet\Services\VxD\ VMLDR and sets the StaticVxD value within this key to Vmldr.vxd. This tells Windows to launch the Vmldr.vxd as a service when the computer starts.
After its launch, Oleproc.exe creates a file named Pnpmngr.pci in the \System folder and launches it. Pnpmng.pci opens a network connection on ports 23476 and 23477. In addition, Oleproc.exe modifies the content of the original .shs file without changing its size. Oleproc.exe also deletes Pkg4135.exe from the \Temp folder.
At the end of the infection, Oleproc.exe, Pnpmgr.pc, Vmldr.vxd, and Jpegcomp.exe are created in the \System folder, the key HKEY_LOCAL_MACHINE\CurrentControlSet\Services\VxD\ VMLDR is added to the registry, and the content of the original .shs file is modified. Each subsequent infection results in further modifications to the .shs file and the creation of different Oleproc.exe and Pnpmgr.pci files.

Although the functionality of Oleproc.exe and the Pnpmgr.pci do not change, the PE headers, contents of the Import Tables, and the contents and the names of several sections change within both files.

At startup, the Vmldr.vxd launches the Pnpmgr.pci, which opens a network connection.





Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.


To remove the Backdoor.Smorph Trojan:

Remove the .shs file. (This Trojan is polymorphic, and the file will have a different name each time.)
Delete Oleproc.exe, Pnpmgr.pci, Vmldr.vxd, and Jpegcomp.dll from the C\Windows\System folder.
Restart Windows in Safe mode.
Delete the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Vxd\VMLDR subkey.

See the sections that follow for detailed instructions.

To remove the .shs file
Click Start, point to Find, and then click Files or Folders. The Find: All files dialog box appears.
Make sure that "Look in" is pointing to C: or All Drives, and that "Include subfolders" is checked.
In the Named box, type *.shs and then click Find Now. Windows find all files and folders that match your search criteria and displays them in the lower pane of the Find dialog box.
What you do next depends on which files are found. Because this Trojan is polymorphic, the file will have a different name each time. There is no way for Symantec to advise you on whether the file is part of the Trojan or is used by a legitimate program. Do one of the following:
Delete the resultant .shs files.
Record the location of each file, and move--do not copy--the files to a floppy disk.
Keep the Find: All files dialog box open, and proceed to the next section.

To delete the Trojan files:
Click New Search, and click OK to clear.
Make sure that Look in is pointing to the drive on which Windows is installed, and that Include subfolders is checked.
In the Named box, type (or copy and paste) the following text, and then click Find Now:

oleproc.exe pnpmgr.pci vmldr.vxd jpegcomp.dll

Delete the resultant files.

To restart the computer in Safe mode:

NOTE: In Safe mode, Windows uses default settings: VGA monitor, no network, Microsoft mouse driver, and the minimum device drivers required to start Windows. You will not have access to CD-ROM drives, printers, or other devices.

Windows 95
Exit all programs.
Click Start, and click Shut Down. The Shut Down Windows dialog box appears.
Click Shut Down, and then click OK.
Click Yes to confirm the shutdown.
Turn off the computer (if necessary) and wait 30 seconds.

NOTE: You must turn off the power to remove the virus from memory. Do not use the reset button.

Turn on the computer.
When "Starting Windows 95..." appears on the screen, press F8. The Windows 95 Startup Menu appears.
Press the number that corresponds to Safe mode, and then press Enter. Windows starts in Safe mode.

Windows 98
Click Start, and click Run.
Type msconfig and then click OK. The System Configuration Utility dialog box appears.
Click Advanced on the General tab.
Check Enable Startup Menu, click OK, and then click OK again.
Exit all programs.
Click Start, and click Shut Down. The Shut Down Windows dialog box appears.
Click Shut Down, and then click OK.
Click Yes to confirm the shutdown.
Turn off the computer and wait 30 seconds.

NOTE: You must turn off the power to remove the virus from memory. Do not use the reset button.

Turn on the computer, and wait for the Windows 98 Startup menu.
Press the number that corresponds to Safe mode, and then press Enter. Windows starts in Safe mode.

NOTE (Windows 98 users only): After you have finished removing the Trojan, you can return to this section and follow these steps to disable the Startup menu:
Click Start, and click Run.
Type msconfig and then click OK. The System Configuration Utility dialog box appears.
Click Advanced on the General tab.
Uncheck Enable Startup Menu, click OK, and then click OK again.
Restart the computer.

Windows 2000
Exit all programs.
Click Start, and click Shut Down. The Shut Down Windows dialog box appears.
Click Shut Down, and then click OK.
Click Yes to confirm the shutdown.
Turn off the computer and wait 30 seconds.

NOTE: You must turn off the power to remove the virus from memory. Do not use the reset button.

Turn on the computer.
As the computer restarts, you will see a continuous line along the bottom of the screen that looks similar to this: |||||||||||||||||||||||||||||. Beneath this line you will see the text "For trouble-shooting and advanced startup options for Windows 2000, press F8." Immediately press F8.
Press the number that corresponds to Safe mode, and then press Enter. Windows starts in Safe mode.

To delete the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Vxd\VMLDR subkey:

CAUTION: We strongly recommend that you back up the system registry before making any changes to it. Incorrect changes to the registry may result in permanent data loss or corrupted files. Be sure to modify the specified keys only. See the document How to back up the Windows registry before proceeding.

To edit the registry:
Click Start, and click Run. The Run dialog box appears.
Type regedit and then click OK. The Registry Editor opens.
Navigate to and select the following subkey:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Vxd\VMLDR

Press Delete, and then click Yes to confirm.
Click Exit to save the changes and close the Registry Editor.

[linet]

HELP NOW... whole DESKTOP IS LOST!!!!


Basically...... ermmm..... i can't even see my icons at all anymore.... when i open... all i see is my screensaver... no icons no nothing.

This happened after the computer suddenly crashed on me the last round....

I can get online by chance by pressing Ctrl-Alt-Del and ask it to open a html file....

I tried goingonto safemode and safemode with connection.... and both just gets stuck..... i am SO going to cry.


Is there something wrong with my startup?in my startup processes, the desktop executive and ffisearch.exe are unchecked..... i tried to check the box, apply and restart.... but when i restart... the same prob occur and they are STILL unchecked!!

HELP.....

[linet]

ok now.... it decided that it will work as normal on safemode... as in... the icons still comes up as per normal.... but not when i boot it normally....

HOw?

[linet]

i was having the computer in safemode... when the same things happened... the pop up command dialogoe box, then a "download pop up" and all the pop ups come back in...

BUT this time.... i noticed that the "download pop up" is actually not a download.... it is a delete thingey....
It shows the file FEFKgn.ini deleting.. (very sure it is ini at the back... and the first 4 letters... FEFK quite confident of them too....) Does this help?

and my normal desktop is still not working....

[linet]

oh and these 3 files just keeps coming back regardless of how many times i delete it.

C:\WINXP\isrvs\desktop.exe
C:\winxp\system32\zcsdpj.exe
C:\winxp\isrvs\icons
C:\dfsdf.exe
C:\eree.exe
C:\ftt.exe
C:\dddd.exe
C:\dfe.exe

[nightowl]

Virus and Trojans :eww

Theres just so much I can do online. You need to bring it to a professional where they can actually look at it. You probably will have to reinstall windows. Best to bring it to an independent Computer repair man, If you bring it to department store you may have to wait for days. Independents have less customers so may get it fixed faster. Make sure to tell them to save all the programs you need..

Doing this over and over is just a waste of your time and mine. Good Luck.........Jim