Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Please help me remove a Trojan (TR/Hiloti.55808.D.10)

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Please help me remove a Trojan (TR/Hiloti.55808.D.10)

Unread postby rog2010 » June 19th, 2010, 2:33 pm

Hi,

I hope someone can and will help me remove/fix the problem that has just started with my last p.c. restart. It doesn't seem to prevent me from using any programs, but I'm not comfortable logging into any of my sites until this is gone/under control.

I keep getting messages generated by Avira telling me that there is an "Error Loading C:\Windows\dxmochg.dll" "Access is Denied."

Here is my hijackthis log:

C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Owner\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mfonup] rundll32.exe "C:\WINDOWS\dxmochg.dll",Startup
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: my.magicJack.com
O15 - Trusted Zone: reg.talk4free.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: CachemanXP (CachemanXPService) - Outertech - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

And here is my Uninstall Log:

3ivx MPEG-4 5.0.3 (remove only)
7-Zip 4.65
Acala DVD Copy 3.3.2
Active@ ISO Burner
Adobe Acrobat 5.0
Adobe AIR
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Media Player
Adobe Reader 8.2.2
Adobe Shockwave Player 11
AllerCalc
Apple Software Update
Applian FLV Player
Armand Morin's Header Generator
ATI - Software Uninstall Utility
Audacity 1.2.6
Avira AntiVir Personal - Free Antivirus
AVS Update Manager 1.0
Canon MP Navigator EX 1.0
Canon MX310 series
Canon MX310 series User Registration
Canon My Printer
Canon Pro9500 series
Canon Pro9500 series User Registration
Canon Setup Utility 2.2
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Easy-PhotoPrint Pro
Canon Utilities Solution Menu
CCleaner
CDDRV_Installer
CloneCD
CoffeeCup Ad Producer
CoffeeCup Direct FTP 6.5.5
CoffeeCup Flash Blogger - Registered
CoffeeCup Flash FireStarter
CoffeeCup Flash Menu Builder
CoffeeCup Flash Password Wizard
CoffeeCup Flash Website Font
CoffeeCup Flash Website Font Pack
CoffeeCup Flash Website Search - Registered
CoffeeCup GIF Animator
CoffeeCup Google SiteMapper
CoffeeCup HTML Editor 2008
CoffeeCup HTML Editor After Twilight Pack
CoffeeCup HTML Editor Bright Side Pack
CoffeeCup HTML Editor Essentials Pack
CoffeeCup HTML Editor Sophistication Pack
CoffeeCup Image Mapper
CoffeeCup Live Chat - Registered
CoffeeCup LockBox
CoffeeCup MP3 Rip & Burn
CoffeeCup Photo Gallery - Registered
CoffeeCup PixConverter
CoffeeCup RSS News Flash - Registered
CoffeeCup Shopping Cart Creator
CoffeeCup Shopping Cart Creator
CoffeeCup Shopping Cart Creator After Twilight Pack
CoffeeCup Shopping Cart Creator Bright Side Pack
CoffeeCup Shopping Cart Creator Google Checkout Activation
CoffeeCup Shopping Cart Creator Sophistication Pack
CoffeeCup StyleSheet Maker
CoffeeCup Visual Site Designer Software
CoffeeCup Web Calendar
CoffeeCup Web Form Builder - Registered
CoffeeCup Web JukeBox - Registered
CoffeeCup Web Video Player - Registered
CoffeeCup Web Video Recorder
CoffeeCup WebCam
CoffeeCup Website Color Schemer
Content Bully
ConvertHelper 2.2
Copy Utility
Defraggler
Domain Name Analyzer Pro v4.0.092206
Easy Cash Manager
EPSON Photo Print
EPSON Smart Panel
EPSON TWAIN 5
Expert WP Keywords Fetcher
eyeQ
ffdshow [rev 1299] [2007-06-17]
FileZilla Client 3.3.2.1
FlipShare
Forms Generator
Freecorder Toolbar
Freecorder Toolbar 3.02 Application
FreeMind
GIMP 2.6.4
GnuCash 2.2.9
Google AdWords Editor
Google Desktop
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB943232)
Java(TM) 6 Update 15
Java(TM) 6 Update 4
Java(TM) 6 Update 7
KhalInstallWrapper
KONICA MINOLTA magicolor 2500W
Logitech Desktop Messenger
Logitech Registration
Logitech SetPoint
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office Publisher 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Windows Script 5.7
Mindjet MindManager Viewer 7
Mozilla Firefox (3.6.3)
Mozilla Thunderbird (3.0.1)
MSXML 6.0 Parser (KB933579)
NoteTab Pro 5 Trial (Remove only)
NVIDIA Drivers
OpenOffice.org 3.1
Paint.NET v3.5.2
PasswordLockboxPro
PF1250-1650 Guide
PowerDVD Ultra
Presto! PageManager 7.15.16
QuickTime
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Replay Converter 3
Replay Media Catcher 3.01
RevenueWire Keyword Manager
Sales Letter Creator 1.4
ScanSoft OmniPage SE 4
ScanToWeb
SeaMonkey (1.1.18)
SeaMonkey (2.0.3)
Serif PhotoPlus 10
Skype web features
Skype™ 4.1
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
The 5 Bucks a Day Action Enforcer
Tube Increaser
UltimateDefrag V1 FREE Public Domain Version
VC 9.0 Runtime
Website Legal Forms Generator
Windows Imaging Component
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Media Player Firefox Plugin
WordFlood 1.2 (remove only)
Yahoo! Install Manager
Yahoo! Messenger
Yahoo! Widgets
ZoneAlarm
ZoneAlarm Toolbar

Thank you in advance for any help you may be able to offer in this matter.

Rog
rog2010
Active Member
 
Posts: 1
Joined: June 19th, 2010, 1:47 pm
Advertisement
Register to Remove

Re: Please help me remove a Trojan (TR/Hiloti.55808.D.10)

Unread postby NonSuch » June 20th, 2010, 1:01 am

In order for someone to analyze your HijackThis log, you must post the entire log, first line through last. The log you have posted has the entire header missing, which includes important information about your computer. You will need to provide us with a complete HijackThis log before we can help you. Please follow the guideline at the link below to start a new topic and post your HijackThis log.

This topic is now closed. Please start a new topic by following the HijackThis Guideline posted here: >Guideline for posting your HijackThis log<
User avatar
NonSuch
Administrator
Administrator
 
Posts: 28747
Joined: February 23rd, 2005, 7:08 am
Location: California


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 279 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware