Is this a hijack?

[mattie]

Hello

would be really grateful for any help. This is the hijack this log,and the symptoms are that computer is running slow - it's unuseable ( in fact this is being posted via another computer) - also the browser window sometimes opens and sometimes doesn't , and sometimes shoots off into another browser which hasn't been opened. The browser seems to return search results, but when you click on one, it takes an absolute age. I have downloaded and run Ad adware, cw shredder, ewido,and a squared, and loads of spyware was identified and removed but computer is still as slow as ever. Would be so very grateful if someone can help me.

Logfile of HijackThis v1.99.1
Scan saved at 11:11:25, on 14/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\BTBROA~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\BT Broadband 205\Help\bin\mpbtn.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\MONA1~1\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.supanet.com/search/iepanel/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.supanet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/cust ... _side.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2C662A2C-00C8-47D3-8F50-76C8389FEA7d} - C:\WINDOWS\system32\eeabcqjh.dll (file missing)
O2 - BHO: (no name) - {468D309B-1734-4C70-8A33-4E8758A927A0} - C:\WINDOWS\system32\eeabcqjh.dll (file missing)
O2 - BHO: (no name) - {50153F5A-DA61-4F24-8269-39842268A8B2} - C:\WINDOWS\system32\eeabcqjh.dll (file missing)
O2 - BHO: (no name) - {FC1613B0-5B70-49D7-B5FB-9CD531FD19F3} - C:\WINDOWS\system32\eeabcqjh.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Broadband Desktop Help.lnk = C:\Program Files\BT Broadband 205\Help\bin\matcli.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.supanet.com/
O20 - Winlogon Notify: execmhnh - C:\WINDOWS\SYSTEM32\execmhnh.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: iwqviglu - C:\WINDOWS\SYSTEM32\iwqviglu.dll
O20 - Winlogon Notify: mvjgnmga - C:\WINDOWS\SYSTEM32\mvjgnmga.dll
O20 - Winlogon Notify: omoyefhe - C:\WINDOWS\SYSTEM32\omoyefhe.dll
O20 - Winlogon Notify: rbsjiffg - C:\WINDOWS\SYSTEM32\rbsjiffg.dll
O20 - Winlogon Notify: rlwmmkck - C:\WINDOWS\SYSTEM32\rlwmmkck.dll
O20 - Winlogon Notify: tecrlvfl - C:\WINDOWS\SYSTEM32\tecrlvfl.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Thanks.

[Jag11]

Hi and welcome to MalwareRemoval

I'm Jet Ian , and I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

[Jag11]

Hi,

Show Hidden Files and Folders

Click Start » My Computer » Tools » Folder Options. Select the View tab.

• Check - Show hidden files and folders
• Uncheck - Hide file extensions for known types
• Uncheck - Hide protected operating system files

Click Yes to confirm, then OK to exit.

=====================================

IMPORTANT! Before following the next steps, please do this first.

Find these files -

C:\WINDOWS\SYSTEM32\execmhnh.dll
C:\WINDOWS\SYSTEM32\iwqviglu.dll
C:\WINDOWS\SYSTEM32\mvjgnmga.dll
C:\WINDOWS\SYSTEM32\omoyefhe.dll
C:\WINDOWS\SYSTEM32\rbsjiffg.dll
C:\WINDOWS\SYSTEM32\rlwmmkck.dll
C:\WINDOWS\SYSTEM32\tecrlvfl.dll
C:\WINDOWS\SYSTEM32\eeabcqjh.dll

And then zip them (to zip files, right-click 'all' of them and then right-click, then select Send To, then select Compressed 'zipped' folder). After zipping it, send it to this email -

pleiadesATshawDOTca (will need to replace AT with @ and DOT with .)

=====================================

Please download VundoFix.exe to your Desktop.

• Double-click VundoFix.exe to run it.
• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• It will make a log in C:\vundofix.txt, I need you to post that later.

=====================================

Download Ewido Anti-Malware

• Install Ewido.
• When installing, under Additional Options, uncheck:
  
  • Install background guard
  • Install scan via context menu
• Launch Ewido.
• The program will now open the main screen.
• You will need to update ewido to the latest definition files
  
  • On the left hand side of the main screen click update.
  • Then click on the Start Update button.
• The update will start and a progress bar will show the updates being installed.
• After it has finished, close Ewido, we will use it later.
• If you are having problems with the updater, you can use this link to manually update ewido » Ewido manual updates.

Download Brute Force Uninstaller to your desktop.

• Right click the file on your Desktop, and choose Extract All.
• Click Next.
• In the box to choose where to extract the files to:
• Click Browse.
• Click on the + sign next to My Computer
• Click on Local Disk (C:) or whatever your primary drive is.
• Click Make New Folder
• Type in BFU
• Click Next, and Uncheck the Show Extracted Files box and then click Finish.

Right-click Here and choose "Save As" (in IE it's "Save Target As").

• Save it in the same folder you made earlier (c:\BFU)

=====================================

Boot into Safe Mode. Please restart your computer and before the Windows logo appear, tap F8 repeatedly. A menu should appear, select Safe Mode from the menu and then hit Enter on your keyboard. (this will take a while, so don't worry, just wait)

=====================================

Run Ewido

• Please close all Windows, Programs or Browsers.
• Open Ewido.
• Click on scanner at the left side, then click on Complete System Scan.
  
  • Please don't use the computer while scanning
  • If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose Clean and click Ok.
• Once the scan has completed, click the button located on the bottom of the screen named Save report.
• Save the report to your Desktop.
• Close Ewido.

=====================================

Run Brute Force Uninstaller

Go to Start » My Computer and navigate to the C:\BFU folder.

• Start the Brute Force Uninstaller by doubleclicking BFU.exe
• In the scriptline to execute field type or paste c:\bfu\alcanshorty.bfu
• Press Execute and let it do it’s job. (You ought to see a progress bar if you did this correctly.)
• Wait for the complete script execution box to pop up and press OK.
• Press exit to terminate the BFU program.

=====================================

Restart your computer

=====================================

Post a new HijackThis log along with Ewido's log.

[mattie]

I've just picked up your reply from another computer. Thanks so much Jet - I will try all of that and get back to you to let you know what happens. I'm so grateful for your help.

[Jag11]

No problem Matttie, take your time

[Nick-YF19]

While we appreciate that you may be busy, it has been 14 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.