Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

please help me my computer get crazy!

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

please help me my computer get crazy!

Unread postby codehunter » August 19th, 2007, 10:05 am

C:\$Extend\$ObjID is corrupted and unreadable, here is the Hijackthis log.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:41:18 PM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Jetico\BestCrypt\BC_VE\bcveserv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\Jetico\BESTCR~1\BCResident.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\RootkitRevealer.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\T.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.microsoft.com/microsoftupdate
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [BestCrypt Volume Encryption] "C:\Program Files\Jetico\BestCrypt Volume Encryption\bcfmgr.exe" MountAtLogon
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ASAPHook hplun.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: bcveServ - Unknown owner - C:\Program Files\Jetico\BestCrypt\BC_VE\bcveserv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: T - Sysinternals - http://www.sysinternals.com - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\T.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



Also here is Rootkitreveal scan


HKU\S-1-5-21-854245398-515967899-682003330-500\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY* 7/22/2007 10:36 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAC* 7/6/2007 9:32 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 7/6/2007 9:32 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet001\Services\psched2k 8/19/2007 1:32 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\riont 8/19/2007 1:31 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg 7/24/2007 6:02 PM 0 bytes Access is denied.
HKLM\SYSTEM\ControlSet001\Services\srvex 8/19/2007 1:31 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Services\psched2k 8/19/2007 1:32 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Services\riont 8/19/2007 1:31 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Services\srvex 8/19/2007 1:31 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\27bio29i.default\sessionstore.js.moztmp 8/19/2007 1:21 PM 24.42 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Administrator\Application Data\SmartFTP\Client 2.0\Cache 8/19/2007 1:40 PM 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Administrator\Cookies\administrator@CAU4JD50.txt 8/19/2007 1:38 PM 690 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Administrator\Cookies\administrator@yahoo[3].txt 8/19/2007 1:53 PM 690 bytes Hidden from Windows API.
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF946F.tmp 8/19/2007 1:54 PM 16.00 KB Hidden from Windows API.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EBWO1IZ0\client_ad[5].htm 8/19/2007 1:53 PM 2.85 KB Hidden from Windows API.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\LIPBYABC\client_ad[6].htm 8/19/2007 1:46 PM 1.88 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache4A99EE9d01 8/19/2007 1:50 PM 469 bytes Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\2DDB702Ed01 8/19/2007 1:50 PM 1.58 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\2E3FB6D1d01 8/19/2007 1:50 PM 11.77 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\456C4C2Dd01 8/19/2007 1:50 PM 2.98 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\58C77768d01 8/19/2007 1:50 PM 472 bytes Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\5900ABBBd01 8/19/2007 1:50 PM 2.85 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\5F24ABD2d01 8/19/2007 1:50 PM 1.50 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\648C18DEd01 8/19/2007 1:49 PM 6.85 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\6F0C84E1d01 8/19/2007 1:50 PM 2.95 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\84B83CF8d01 8/19/2007 1:49 PM 3.55 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\9E121296d01 8/19/2007 1:50 PM 2.95 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\_CACHE_001_ 8/19/2007 1:53 PM 35.75 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\_CACHE_002_ 8/19/2007 1:53 PM 4.00 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\_CACHE_003_ 8/19/2007 1:53 PM 4.00 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\_CACHE_MAP_ 8/19/2007 1:53 PM 4.00 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\gecko\usr\Profiles\Guest\2qy5zxm0.slt\Cache\ECEFB6D8d01 8/19/2007 1:50 PM 11.77 KB Hidden from Windows API.
C:\Program Files\CompuServe 7.0\idb\main.ind 8/19/2007 11:19 AM 52.84 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\CompuServe 7.0\idb\STYLE.ind 8/19/2007 11:19 AM 292 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\CompuServe 7.0\idb\sysne87.ind 8/19/2007 1:49 PM 292 bytes Hidden from Windows API.
C:\Program Files\CompuServe 7.0\idb\sysnews.ind 8/19/2007 11:19 AM 292 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\CompuServe 7.0\idb\Toolbar.ind 8/19/2007 11:19 AM 292 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\ESET\cache\FND0.NFI 8/19/2007 12:50 PM 277 bytes Visible in Windows API, MFT, but not in directory index.
C:\Program Files\Yahoo!\Messenger\ystats_B.dat 8/19/2007 1:53 PM 28 bytes Hidden from Windows API.
C:\WINDOWS\system32\CatRoot2\res1.log 7/6/2007 2:03 AM 128.00 KB Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\system32\CatRoot2\res2.log 7/6/2007 2:03 AM 128.00 KB Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\system32\drivers\psched2k.sys 8/9/2007 2:20 PM 451.25 KB Hidden from Windows API.
C:\WINDOWS\system32\drivers\riont.sys 8/9/2007 2:20 PM 16.50 KB Hidden from Windows API.
C:\WINDOWS\system32\drivers\srvex.sys 8/9/2007 2:20 PM 16.88 KB Hidden from Windows API.
C:\WINDOWS\system32\edlinsvr.exe 8/9/2007 2:20 PM 2.11 MB Hidden from Windows API.
C:\WINDOWS\system32\rasa32.dll 8/9/2007 2:20 PM 100.00 KB Hidden from Windows API.
C:\WINDOWS\system32\xencache.dll 8/19/2007 1:32 PM 246.85 MB Hidden from Windows API.
codehunter
Active Member
 
Posts: 1
Joined: August 19th, 2007, 10:03 am
Advertisement
Register to Remove

Unread postby Elrond » August 20th, 2007, 12:58 am

The Original Poster is being helped at SpywareInfo.
Please do not post your request for help at more than one help forum
There is a limited pool of helpers that work at multiple forums. The only effect posting at more than one help forum has is to waste the helpers time which is a precious asset.
User avatar
Elrond
Admin/Teacher Emeritus
 
Posts: 8818
Joined: February 17th, 2005, 9:14 pm
Location: Jerusalem


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 43 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware