Malware Removal Forums

please help me rid this from my copmuter

darrin06241985 · 2005-06-17T04:00:15+00:00

when i log into my computer that has windows xp the backround turns blue and say something like a fatal error has occured at002B:C001[DG in VHD VMM{01) 0001DE36. Error was caused by Trojan-Spy.HTML.Suitfraud.c *System can not function in normal mode please check your security settings. * Scan your PC with any avaliable antivirus/ spyware remover program to fix the problem. Im not to sure if that is exactly what is says cause it is written very small. I have ran nortons anivirus 2005, Ad-Aware SE and Spybot Search-and destroy and it is still there. Every once in a while the screen just goes black and then comes back on and the computer is running very very slow and is restarts whenever it feels like it. here is the results of my hijackthis scan. does any of this need to be removed or is there anything i can do to get rid of this??? PLEASE HELP! Im not very good with computers so can you please help and try to give me directions on how exactly to fix this. Logfile of HijackThis v1.99.1 S

81 min read

Bertha

August 10, 2005, 10:58 PM UTC

Hi darrin,

No i will reply, its just late now so I will reply tomorrow morning
(Please remeber that we do this as an Interest, and time is a factor)

Bertha

Bertha

August 14, 2005, 3:50 PM UTC

Hi,

Sorry for the wait, if you still require assisstance please post a new HJT log

Bertha

darrin06241985

August 17, 2005, 2:39 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 8:35:30 PM, on 8/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\secserv.exe
C:\WINDOWS\System32\secserv.exe
C:\WINDOWS\System32\l?ass.exe
C:\Program Files\tlop\aapu.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Documents and Settings\Alyssa\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)
O1 - Hosts: 66.180.173.39 http://www.google.ae
O1 - Hosts: 66.180.173.39 http://www.google.am
O1 - Hosts: 66.180.173.39 http://www.google.as
O1 - Hosts: 66.180.173.39 http://www.google.at
O1 - Hosts: 66.180.173.39 http://www.google.az
O1 - Hosts: 66.180.173.39 http://www.google.be
O1 - Hosts: 66.180.173.39 http://www.google.bi
O1 - Hosts: 66.180.173.39 http://www.google.ca
O1 - Hosts: 66.180.173.39 http://www.google.cd
O1 - Hosts: 66.180.173.39 http://www.google.cg
O1 - Hosts: 66.180.173.39 http://www.google.ch
O1 - Hosts: 66.180.173.39 http://www.google.ci
O1 - Hosts: 66.180.173.39 http://www.google.cl
O1 - Hosts: 66.180.173.39 http://www.google.co.cr
O1 - Hosts: 66.180.173.39 http://www.google.co.hu
O1 - Hosts: 66.180.173.39 http://www.google.co.il
O1 - Hosts: 66.180.173.39 http://www.google.co.in
O1 - Hosts: 66.180.173.39 http://www.google.co.je
O1 - Hosts: 66.180.173.39 http://www.google.co.jp
O1 - Hosts: 66.180.173.39 http://www.google.co.ke
O1 - Hosts: 66.180.173.39 http://www.google.co.kr
O1 - Hosts: 66.180.173.39 http://www.google.co.ls
O1 - Hosts: 66.180.173.39 http://www.google.co.nz
O1 - Hosts: 66.180.173.39 http://www.google.co.th
O1 - Hosts: 66.180.173.39 http://www.google.co.ug
O1 - Hosts: 66.180.173.39 http://www.google.co.uk
O1 - Hosts: 66.180.173.39 http://www.google.co.ve
O1 - Hosts: 66.180.173.39 http://www.google.com
O1 - Hosts: 66.180.173.39 http://www.google.com.ag
O1 - Hosts: 66.180.173.39 http://www.google.com.ar
O1 - Hosts: 66.180.173.39 http://www.google.com.au
O1 - Hosts: 66.180.173.39 http://www.google.com.br
O1 - Hosts: 66.180.173.39 http://www.google.com.co
O1 - Hosts: 66.180.173.39 http://www.google.com.cu
O1 - Hosts: 66.180.173.39 http://www.google.com.do
O1 - Hosts: 66.180.173.39 http://www.google.com.ec
O1 - Hosts: 66.180.173.39 http://www.google.com.fj
O1 - Hosts: 66.180.173.39 http://www.google.com.gi
O1 - Hosts: 66.180.173.39 http://www.google.com.gr
O1 - Hosts: 66.180.173.39 http://www.google.com.gt
O1 - Hosts: 66.180.173.39 http://www.google.com.hk
O1 - Hosts: 66.180.173.39 http://www.google.com.ly
O1 - Hosts: 66.180.173.39 http://www.google.com.mt
O1 - Hosts: 66.180.173.39 http://www.google.com.mx
O1 - Hosts: 66.180.173.39 http://www.google.com.my
O1 - Hosts: 66.180.173.39 http://www.google.com.na
O1 - Hosts: 66.180.173.39 http://www.google.com.nf
O1 - Hosts: 66.180.173.39 http://www.google.com.ni
O1 - Hosts: 66.180.173.39 http://www.google.com.np
O1 - Hosts: 66.180.173.39 http://www.google.com.pa
O1 - Hosts: 66.180.173.39 http://www.google.com.pe
O1 - Hosts: 66.180.173.39 http://www.google.com.ph
O1 - Hosts: 66.180.173.39 http://www.google.com.pk
O1 - Hosts: 66.180.173.39 http://www.google.com.pr
O1 - Hosts: 66.180.173.39 http://www.google.com.py
O1 - Hosts: 66.180.173.39 http://www.google.com.sa
O1 - Hosts: 66.180.173.39 http://www.google.com.sg
O1 - Hosts: 66.180.173.39 http://www.google.com.sv
O1 - Hosts: 66.180.173.39 http://www.google.com.tr
O1 - Hosts: 66.180.173.39 http://www.google.com.tw
O1 - Hosts: 66.180.173.39 http://www.google.com.ua
O1 - Hosts: 66.180.173.39 http://www.google.com.uy
O1 - Hosts: 66.180.173.39 http://www.google.com.vc
O1 - Hosts: 66.180.173.39 http://www.google.com.vn
O1 - Hosts: 66.180.173.39 http://www.google.de
O1 - Hosts: 66.180.173.39 http://www.google.dj
O1 - Hosts: 66.180.173.39 http://www.google.dk
O1 - Hosts: 66.180.173.39 http://www.google.es
O1 - Hosts: 66.180.173.39 http://www.google.fi
O1 - Hosts: 66.180.173.39 http://www.google.fm
O1 - Hosts: 66.180.173.39 http://www.google.fr
O1 - Hosts: 66.180.173.39 http://www.google.gg
O1 - Hosts: 66.180.173.39 http://www.google.gl
O1 - Hosts: 66.180.173.39 http://www.google.gm
O1 - Hosts: 66.180.173.39 http://www.google.hn
O1 - Hosts: 66.180.173.39 http://www.google.ie
O1 - Hosts: 66.180.173.39 http://www.google.it
O1 - Hosts: 66.180.173.39 http://www.google.kz
O1 - Hosts: 66.180.173.39 http://www.google.li
O1 - Hosts: 66.180.173.39 http://www.google.lt
O1 - Hosts: 66.180.173.39 http://www.google.lu
O1 - Hosts: 66.180.173.39 http://www.google.lv
O1 - Hosts: 66.180.173.39 http://www.google.mn
O1 - Hosts: 66.180.173.39 http://www.google.ms
O1 - Hosts: 66.180.173.39 http://www.google.mu
O1 - Hosts: 66.180.173.39 http://www.google.mw
O1 - Hosts: 66.180.173.39 http://www.google.nl
O1 - Hosts: 66.180.173.39 http://www.google.no
O1 - Hosts: 66.180.173.39 http://www.google.off.ai
O1 - Hosts: 66.180.173.39 http://www.google.pl
O1 - Hosts: 66.180.173.39 http://www.google.pn
O1 - Hosts: 66.180.173.39 http://www.google.pt
O1 - Hosts: 66.180.173.39 http://www.google.ro
O1 - Hosts: 66.180.173.39 http://www.google.ru
O1 - Hosts: 66.180.173.39 http://www.google.rw
O1 - Hosts: 66.180.173.39 http://www.google.se
O1 - Hosts: 66.180.173.39 http://www.google.sh
O1 - Hosts: 66.180.173.39 http://www.google.sk
O1 - Hosts: 66.180.173.39 http://www.google.sm
O1 - Hosts: 66.180.173.39 http://www.google.td
O1 - Hosts: 66.180.173.39 http://www.google.tm
O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\Alyssa\LOCALS~1\Temp\sdmfclkruti.dll (file missing)
O2 - BHO: SDWin32 Class - {80CFA6CE-29E7-4AEB-B0D6-80E96DE2EF38} - C:\WINDOWS\System32\phfwy.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [18i71lvt] C:\WINDOWS\System32\18i71lvt.exe
O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [apisvc.exe] C:\WINDOWS\System32\apisvc.exe
O4 - HKLM\..\Run: [secserv.exe] C:\WINDOWS\System32\secserv.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKCU\..\Run: [byr5RXGmh] umdax.exe
O4 - HKCU\..\Run: [Yofgpd] C:\WINDOWS\System32\l?ass.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [Smob] C:\Program Files\tlop\aapu.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\csutil.dll
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

Bertha

August 17, 2005, 5:56 PM UTC

Hi.

Lets run some scans to see what they pick up for us,

Download AdAware Se and SpyBot from here

http://www.malwareremoval.com/forum/viewtopic.php?t=13

Set them up as shown and run them, rebooting between each one

Then update to AVG 7 it appears you are using an out of date version, click on Update in your AVG options, and it should prompt you,

If not donwload the latest version from here

http://free.grisoft.com/freeweb.php/doc/2/

Run it and reboot after the scan

Note down anyhting from these scans that they find but cannot remove and its location, then post that and a new Log back here

Bertha

darrin06241985

August 27, 2005, 1:55 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 7:54:49 PM, on 8/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\secserv.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\secserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\l?ass.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Documents and Settings\Alyssa\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)
O1 - Hosts: 66.180.173.39 http://www.google.ae
O1 - Hosts: 66.180.173.39 http://www.google.am
O1 - Hosts: 66.180.173.39 http://www.google.as
O1 - Hosts: 66.180.173.39 http://www.google.at
O1 - Hosts: 66.180.173.39 http://www.google.az
O1 - Hosts: 66.180.173.39 http://www.google.be
O1 - Hosts: 66.180.173.39 http://www.google.bi
O1 - Hosts: 66.180.173.39 http://www.google.ca
O1 - Hosts: 66.180.173.39 http://www.google.cd
O1 - Hosts: 66.180.173.39 http://www.google.cg
O1 - Hosts: 66.180.173.39 http://www.google.ch
O1 - Hosts: 66.180.173.39 http://www.google.ci
O1 - Hosts: 66.180.173.39 http://www.google.cl
O1 - Hosts: 66.180.173.39 http://www.google.co.cr
O1 - Hosts: 66.180.173.39 http://www.google.co.hu
O1 - Hosts: 66.180.173.39 http://www.google.co.il
O1 - Hosts: 66.180.173.39 http://www.google.co.in
O1 - Hosts: 66.180.173.39 http://www.google.co.je
O1 - Hosts: 66.180.173.39 http://www.google.co.jp
O1 - Hosts: 66.180.173.39 http://www.google.co.ke
O1 - Hosts: 66.180.173.39 http://www.google.co.kr
O1 - Hosts: 66.180.173.39 http://www.google.co.ls
O1 - Hosts: 66.180.173.39 http://www.google.co.nz
O1 - Hosts: 66.180.173.39 http://www.google.co.th
O1 - Hosts: 66.180.173.39 http://www.google.co.ug
O1 - Hosts: 66.180.173.39 http://www.google.co.uk
O1 - Hosts: 66.180.173.39 http://www.google.co.ve
O1 - Hosts: 66.180.173.39 http://www.google.com
O1 - Hosts: 66.180.173.39 http://www.google.com.ag
O1 - Hosts: 66.180.173.39 http://www.google.com.ar
O1 - Hosts: 66.180.173.39 http://www.google.com.au
O1 - Hosts: 66.180.173.39 http://www.google.com.br
O1 - Hosts: 66.180.173.39 http://www.google.com.co
O1 - Hosts: 66.180.173.39 http://www.google.com.cu
O1 - Hosts: 66.180.173.39 http://www.google.com.do
O1 - Hosts: 66.180.173.39 http://www.google.com.ec
O1 - Hosts: 66.180.173.39 http://www.google.com.fj
O1 - Hosts: 66.180.173.39 http://www.google.com.gi
O1 - Hosts: 66.180.173.39 http://www.google.com.gr
O1 - Hosts: 66.180.173.39 http://www.google.com.gt
O1 - Hosts: 66.180.173.39 http://www.google.com.hk
O1 - Hosts: 66.180.173.39 http://www.google.com.ly
O1 - Hosts: 66.180.173.39 http://www.google.com.mt
O1 - Hosts: 66.180.173.39 http://www.google.com.mx
O1 - Hosts: 66.180.173.39 http://www.google.com.my
O1 - Hosts: 66.180.173.39 http://www.google.com.na
O1 - Hosts: 66.180.173.39 http://www.google.com.nf
O1 - Hosts: 66.180.173.39 http://www.google.com.ni
O1 - Hosts: 66.180.173.39 http://www.google.com.np
O1 - Hosts: 66.180.173.39 http://www.google.com.pa
O1 - Hosts: 66.180.173.39 http://www.google.com.pe
O1 - Hosts: 66.180.173.39 http://www.google.com.ph
O1 - Hosts: 66.180.173.39 http://www.google.com.pk
O1 - Hosts: 66.180.173.39 http://www.google.com.pr
O1 - Hosts: 66.180.173.39 http://www.google.com.py
O1 - Hosts: 66.180.173.39 http://www.google.com.sa
O1 - Hosts: 66.180.173.39 http://www.google.com.sg
O1 - Hosts: 66.180.173.39 http://www.google.com.sv
O1 - Hosts: 66.180.173.39 http://www.google.com.tr
O1 - Hosts: 66.180.173.39 http://www.google.com.tw
O1 - Hosts: 66.180.173.39 http://www.google.com.ua
O1 - Hosts: 66.180.173.39 http://www.google.com.uy
O1 - Hosts: 66.180.173.39 http://www.google.com.vc
O1 - Hosts: 66.180.173.39 http://www.google.com.vn
O1 - Hosts: 66.180.173.39 http://www.google.de
O1 - Hosts: 66.180.173.39 http://www.google.dj
O1 - Hosts: 66.180.173.39 http://www.google.dk
O1 - Hosts: 66.180.173.39 http://www.google.es
O1 - Hosts: 66.180.173.39 http://www.google.fi
O1 - Hosts: 66.180.173.39 http://www.google.fm
O1 - Hosts: 66.180.173.39 http://www.google.fr
O1 - Hosts: 66.180.173.39 http://www.google.gg
O1 - Hosts: 66.180.173.39 http://www.google.gl
O1 - Hosts: 66.180.173.39 http://www.google.gm
O1 - Hosts: 66.180.173.39 http://www.google.hn
O1 - Hosts: 66.180.173.39 http://www.google.ie
O1 - Hosts: 66.180.173.39 http://www.google.it
O1 - Hosts: 66.180.173.39 http://www.google.kz
O1 - Hosts: 66.180.173.39 http://www.google.li
O1 - Hosts: 66.180.173.39 http://www.google.lt
O1 - Hosts: 66.180.173.39 http://www.google.lu
O1 - Hosts: 66.180.173.39 http://www.google.lv
O1 - Hosts: 66.180.173.39 http://www.google.mn
O1 - Hosts: 66.180.173.39 http://www.google.ms
O1 - Hosts: 66.180.173.39 http://www.google.mu
O1 - Hosts: 66.180.173.39 http://www.google.mw
O1 - Hosts: 66.180.173.39 http://www.google.nl
O1 - Hosts: 66.180.173.39 http://www.google.no
O1 - Hosts: 66.180.173.39 http://www.google.off.ai
O1 - Hosts: 66.180.173.39 http://www.google.pl
O1 - Hosts: 66.180.173.39 http://www.google.pn
O1 - Hosts: 66.180.173.39 http://www.google.pt
O1 - Hosts: 66.180.173.39 http://www.google.ro
O1 - Hosts: 66.180.173.39 http://www.google.ru
O1 - Hosts: 66.180.173.39 http://www.google.rw
O1 - Hosts: 66.180.173.39 http://www.google.se
O1 - Hosts: 66.180.173.39 http://www.google.sh
O1 - Hosts: 66.180.173.39 http://www.google.sk
O1 - Hosts: 66.180.173.39 http://www.google.sm
O1 - Hosts: 66.180.173.39 http://www.google.td
O1 - Hosts: 66.180.173.39 http://www.google.tm
O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\Alyssa\LOCALS~1\Temp\jenafcfspgx.dll
O2 - BHO: SDWin32 Class - {68E7A2A9-F198-4FA2-84A9-22E73F1FD264} - C:\WINDOWS\System32\lnilp.dll (file missing)
O2 - BHO: SDWin32 Class - {80CFA6CE-29E7-4AEB-B0D6-80E96DE2EF38} - C:\WINDOWS\System32\phfwy.dll (file missing)
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [18i71lvt] C:\WINDOWS\System32\18i71lvt.exe
O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [apisvc.exe] C:\WINDOWS\System32\apisvc.exe
O4 - HKLM\..\Run: [secserv.exe] C:\WINDOWS\System32\secserv.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [dnam] C:\WINDOWS\system32\d140113.a.Stub.EXE
O4 - HKCU\..\Run: [byr5RXGmh] umdax.exe
O4 - HKCU\..\Run: [Yofgpd] C:\WINDOWS\System32\l?ass.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\csutil.dll
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

darrin06241985

August 31, 2005, 10:35 PM UTC

can you help me with this????

Bertha

September 1, 2005, 3:21 PM UTC

Hi darrin,

sorry for the wait, for some reason Im not getting the emial notifications for this topic

Please do as follows

Download Hoster - Hoster

http://www.funkytoad.com/download/hoster.zip

Save it to your desktop, and then run it, hopefully it will resotre your hosts

Post a new HJT Log back here,

Bertha

darrin06241985

September 2, 2005, 10:53 PM UTC

i think i did it right i opened hoster and clicked on restore original hosts here is the new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 4:51:43 PM, on 9/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\secserv.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\secserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\l?ass.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\tlop\aapu.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Documents and Settings\Alyssa\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)
O1 - Hosts: 66.180.173.39 http://www.google.ae
O1 - Hosts: 66.180.173.39 http://www.google.am
O1 - Hosts: 66.180.173.39 http://www.google.as
O1 - Hosts: 66.180.173.39 http://www.google.at
O1 - Hosts: 66.180.173.39 http://www.google.az
O1 - Hosts: 66.180.173.39 http://www.google.be
O1 - Hosts: 66.180.173.39 http://www.google.bi
O1 - Hosts: 66.180.173.39 http://www.google.ca
O1 - Hosts: 66.180.173.39 http://www.google.cd
O1 - Hosts: 66.180.173.39 http://www.google.cg
O1 - Hosts: 66.180.173.39 http://www.google.ch
O1 - Hosts: 66.180.173.39 http://www.google.ci
O1 - Hosts: 66.180.173.39 http://www.google.cl
O1 - Hosts: 66.180.173.39 http://www.google.co.cr
O1 - Hosts: 66.180.173.39 http://www.google.co.hu
O1 - Hosts: 66.180.173.39 http://www.google.co.il
O1 - Hosts: 66.180.173.39 http://www.google.co.in
O1 - Hosts: 66.180.173.39 http://www.google.co.je
O1 - Hosts: 66.180.173.39 http://www.google.co.jp
O1 - Hosts: 66.180.173.39 http://www.google.co.ke
O1 - Hosts: 66.180.173.39 http://www.google.co.kr
O1 - Hosts: 66.180.173.39 http://www.google.co.ls
O1 - Hosts: 66.180.173.39 http://www.google.co.nz
O1 - Hosts: 66.180.173.39 http://www.google.co.th
O1 - Hosts: 66.180.173.39 http://www.google.co.ug
O1 - Hosts: 66.180.173.39 http://www.google.co.uk
O1 - Hosts: 66.180.173.39 http://www.google.co.ve
O1 - Hosts: 66.180.173.39 http://www.google.com
O1 - Hosts: 66.180.173.39 http://www.google.com.ag
O1 - Hosts: 66.180.173.39 http://www.google.com.ar
O1 - Hosts: 66.180.173.39 http://www.google.com.au
O1 - Hosts: 66.180.173.39 http://www.google.com.br
O1 - Hosts: 66.180.173.39 http://www.google.com.co
O1 - Hosts: 66.180.173.39 http://www.google.com.cu
O1 - Hosts: 66.180.173.39 http://www.google.com.do
O1 - Hosts: 66.180.173.39 http://www.google.com.ec
O1 - Hosts: 66.180.173.39 http://www.google.com.fj
O1 - Hosts: 66.180.173.39 http://www.google.com.gi
O1 - Hosts: 66.180.173.39 http://www.google.com.gr
O1 - Hosts: 66.180.173.39 http://www.google.com.gt
O1 - Hosts: 66.180.173.39 http://www.google.com.hk
O1 - Hosts: 66.180.173.39 http://www.google.com.ly
O1 - Hosts: 66.180.173.39 http://www.google.com.mt
O1 - Hosts: 66.180.173.39 http://www.google.com.mx
O1 - Hosts: 66.180.173.39 http://www.google.com.my
O1 - Hosts: 66.180.173.39 http://www.google.com.na
O1 - Hosts: 66.180.173.39 http://www.google.com.nf
O1 - Hosts: 66.180.173.39 http://www.google.com.ni
O1 - Hosts: 66.180.173.39 http://www.google.com.np
O1 - Hosts: 66.180.173.39 http://www.google.com.pa
O1 - Hosts: 66.180.173.39 http://www.google.com.pe
O1 - Hosts: 66.180.173.39 http://www.google.com.ph
O1 - Hosts: 66.180.173.39 http://www.google.com.pk
O1 - Hosts: 66.180.173.39 http://www.google.com.pr
O1 - Hosts: 66.180.173.39 http://www.google.com.py
O1 - Hosts: 66.180.173.39 http://www.google.com.sa
O1 - Hosts: 66.180.173.39 http://www.google.com.sg
O1 - Hosts: 66.180.173.39 http://www.google.com.sv
O1 - Hosts: 66.180.173.39 http://www.google.com.tr
O1 - Hosts: 66.180.173.39 http://www.google.com.tw
O1 - Hosts: 66.180.173.39 http://www.google.com.ua
O1 - Hosts: 66.180.173.39 http://www.google.com.uy
O1 - Hosts: 66.180.173.39 http://www.google.com.vc
O1 - Hosts: 66.180.173.39 http://www.google.com.vn
O1 - Hosts: 66.180.173.39 http://www.google.de
O1 - Hosts: 66.180.173.39 http://www.google.dj
O1 - Hosts: 66.180.173.39 http://www.google.dk
O1 - Hosts: 66.180.173.39 http://www.google.es
O1 - Hosts: 66.180.173.39 http://www.google.fi
O1 - Hosts: 66.180.173.39 http://www.google.fm
O1 - Hosts: 66.180.173.39 http://www.google.fr
O1 - Hosts: 66.180.173.39 http://www.google.gg
O1 - Hosts: 66.180.173.39 http://www.google.gl
O1 - Hosts: 66.180.173.39 http://www.google.gm
O1 - Hosts: 66.180.173.39 http://www.google.hn
O1 - Hosts: 66.180.173.39 http://www.google.ie
O1 - Hosts: 66.180.173.39 http://www.google.it
O1 - Hosts: 66.180.173.39 http://www.google.kz
O1 - Hosts: 66.180.173.39 http://www.google.li
O1 - Hosts: 66.180.173.39 http://www.google.lt
O1 - Hosts: 66.180.173.39 http://www.google.lu
O1 - Hosts: 66.180.173.39 http://www.google.lv
O1 - Hosts: 66.180.173.39 http://www.google.mn
O1 - Hosts: 66.180.173.39 http://www.google.ms
O1 - Hosts: 66.180.173.39 http://www.google.mu
O1 - Hosts: 66.180.173.39 http://www.google.mw
O1 - Hosts: 66.180.173.39 http://www.google.nl
O1 - Hosts: 66.180.173.39 http://www.google.no
O1 - Hosts: 66.180.173.39 http://www.google.off.ai
O1 - Hosts: 66.180.173.39 http://www.google.pl
O1 - Hosts: 66.180.173.39 http://www.google.pn
O1 - Hosts: 66.180.173.39 http://www.google.pt
O1 - Hosts: 66.180.173.39 http://www.google.ro
O1 - Hosts: 66.180.173.39 http://www.google.ru
O1 - Hosts: 66.180.173.39 http://www.google.rw
O1 - Hosts: 66.180.173.39 http://www.google.se
O1 - Hosts: 66.180.173.39 http://www.google.sh
O1 - Hosts: 66.180.173.39 http://www.google.sk
O1 - Hosts: 66.180.173.39 http://www.google.sm
O1 - Hosts: 66.180.173.39 http://www.google.td
O1 - Hosts: 66.180.173.39 http://www.google.tm
O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\Alyssa\LOCALS~1\Temp\jenafcfspgx.dll
O2 - BHO: SDWin32 Class - {68E7A2A9-F198-4FA2-84A9-22E73F1FD264} - C:\WINDOWS\System32\lnilp.dll (file missing)
O2 - BHO: SDWin32 Class - {80CFA6CE-29E7-4AEB-B0D6-80E96DE2EF38} - C:\WINDOWS\System32\phfwy.dll (file missing)
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [18i71lvt] C:\WINDOWS\System32\18i71lvt.exe
O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [apisvc.exe] C:\WINDOWS\System32\apisvc.exe
O4 - HKLM\..\Run: [secserv.exe] C:\WINDOWS\System32\secserv.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [dnam] C:\WINDOWS\system32\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\ddls4d.exe reg_run
O4 - HKCU\..\Run: [byr5RXGmh] umdax.exe
O4 - HKCU\..\Run: [Yofgpd] C:\WINDOWS\System32\l?ass.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [Smob] C:\Program Files\tlop\aapu.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: ctnr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - C:\WINDOWS\System32\wuauclt.dll
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - C:\WINDOWS\System32\wuauclt.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://hylandhillscamera.axiscam.net/activex/AMC.cab
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\csutil.dll
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

Bertha

September 3, 2005, 5:25 PM UTC

Dar,

-Print this off so you can follow it

Be sure to look this solution over before you begin.

===============

We'll need to unload (not uninstall) Intermute's SpySubtract, since it might interfere with other program(s) we might be using to 'clean' off your system.

===============

Go to www.trendmicro.com, and then:

1. Click "Free Online Scan".
2. Click "Scan now, it's free".

It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:

1. Select all available drives.
2. Check(tick) "Auto Clean".
3. Click "Scan".

When it completes, post back the full filename of any files that cannot be cleaned or deleted.

===============

Go to ADD/Remove (via Control Panel)

Uninstall if there

SudrSideKick

Run HiJackThis then:

1. Click "Config..."
2. Click "Misc Tools"
3. Click "Open Process manager"

-

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

C:\WINDOWS\System32\secserv.exe
C:\WINDOWS\System32\l?ass.exe

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.

===============

Run HiJackThis and click "Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)

O1 - Hosts: 66.180.173.39 http://www.google.ae
O1 - Hosts: 66.180.173.39 http://www.google.am
O1 - Hosts: 66.180.173.39 http://www.google.as
O1 - Hosts: 66.180.173.39 http://www.google.at
O1 - Hosts: 66.180.173.39 http://www.google.az
O1 - Hosts: 66.180.173.39 http://www.google.be
O1 - Hosts: 66.180.173.39 http://www.google.bi
O1 - Hosts: 66.180.173.39 http://www.google.ca
O1 - Hosts: 66.180.173.39 http://www.google.cd
O1 - Hosts: 66.180.173.39 http://www.google.cg
O1 - Hosts: 66.180.173.39 http://www.google.ch
O1 - Hosts: 66.180.173.39 http://www.google.ci
O1 - Hosts: 66.180.173.39 http://www.google.cl
O1 - Hosts: 66.180.173.39 http://www.google.co.cr
O1 - Hosts: 66.180.173.39 http://www.google.co.hu
O1 - Hosts: 66.180.173.39 http://www.google.co.il
O1 - Hosts: 66.180.173.39 http://www.google.co.in
O1 - Hosts: 66.180.173.39 http://www.google.co.je
O1 - Hosts: 66.180.173.39 http://www.google.co.jp
O1 - Hosts: 66.180.173.39 http://www.google.co.ke
O1 - Hosts: 66.180.173.39 http://www.google.co.kr
O1 - Hosts: 66.180.173.39 http://www.google.co.ls
O1 - Hosts: 66.180.173.39 http://www.google.co.nz
O1 - Hosts: 66.180.173.39 http://www.google.co.th
O1 - Hosts: 66.180.173.39 http://www.google.co.ug
O1 - Hosts: 66.180.173.39 http://www.google.co.uk
O1 - Hosts: 66.180.173.39 http://www.google.co.ve
O1 - Hosts: 66.180.173.39 http://www.google.com
O1 - Hosts: 66.180.173.39 http://www.google.com.ag
O1 - Hosts: 66.180.173.39 http://www.google.com.ar
O1 - Hosts: 66.180.173.39 http://www.google.com.au
O1 - Hosts: 66.180.173.39 http://www.google.com.br
O1 - Hosts: 66.180.173.39 http://www.google.com.co
O1 - Hosts: 66.180.173.39 http://www.google.com.cu
O1 - Hosts: 66.180.173.39 http://www.google.com.do
O1 - Hosts: 66.180.173.39 http://www.google.com.ec
O1 - Hosts: 66.180.173.39 http://www.google.com.fj
O1 - Hosts: 66.180.173.39 http://www.google.com.gi
O1 - Hosts: 66.180.173.39 http://www.google.com.gr
O1 - Hosts: 66.180.173.39 http://www.google.com.gt
O1 - Hosts: 66.180.173.39 http://www.google.com.hk
O1 - Hosts: 66.180.173.39 http://www.google.com.ly
O1 - Hosts: 66.180.173.39 http://www.google.com.mt
O1 - Hosts: 66.180.173.39 http://www.google.com.mx
O1 - Hosts: 66.180.173.39 http://www.google.com.my
O1 - Hosts: 66.180.173.39 http://www.google.com.na
O1 - Hosts: 66.180.173.39 http://www.google.com.nf
O1 - Hosts: 66.180.173.39 http://www.google.com.ni
O1 - Hosts: 66.180.173.39 http://www.google.com.np
O1 - Hosts: 66.180.173.39 http://www.google.com.pa
O1 - Hosts: 66.180.173.39 http://www.google.com.pe
O1 - Hosts: 66.180.173.39 http://www.google.com.ph
O1 - Hosts: 66.180.173.39 http://www.google.com.pk
O1 - Hosts: 66.180.173.39 http://www.google.com.pr
O1 - Hosts: 66.180.173.39 http://www.google.com.py
O1 - Hosts: 66.180.173.39 http://www.google.com.sa
O1 - Hosts: 66.180.173.39 http://www.google.com.sg
O1 - Hosts: 66.180.173.39 http://www.google.com.sv
O1 - Hosts: 66.180.173.39 http://www.google.com.tr
O1 - Hosts: 66.180.173.39 http://www.google.com.tw
O1 - Hosts: 66.180.173.39 http://www.google.com.ua
O1 - Hosts: 66.180.173.39 http://www.google.com.uy
O1 - Hosts: 66.180.173.39 http://www.google.com.vc
O1 - Hosts: 66.180.173.39 http://www.google.com.vn
O1 - Hosts: 66.180.173.39 http://www.google.de
O1 - Hosts: 66.180.173.39 http://www.google.dj
O1 - Hosts: 66.180.173.39 http://www.google.dk
O1 - Hosts: 66.180.173.39 http://www.google.es
O1 - Hosts: 66.180.173.39 http://www.google.fi
O1 - Hosts: 66.180.173.39 http://www.google.fm
O1 - Hosts: 66.180.173.39 http://www.google.fr
O1 - Hosts: 66.180.173.39 http://www.google.gg
O1 - Hosts: 66.180.173.39 http://www.google.gl
O1 - Hosts: 66.180.173.39 http://www.google.gm
O1 - Hosts: 66.180.173.39 http://www.google.hn
O1 - Hosts: 66.180.173.39 http://www.google.ie
O1 - Hosts: 66.180.173.39 http://www.google.it
O1 - Hosts: 66.180.173.39 http://www.google.kz
O1 - Hosts: 66.180.173.39 http://www.google.li
O1 - Hosts: 66.180.173.39 http://www.google.lt
O1 - Hosts: 66.180.173.39 http://www.google.lu
O1 - Hosts: 66.180.173.39 http://www.google.lv
O1 - Hosts: 66.180.173.39 http://www.google.mn
O1 - Hosts: 66.180.173.39 http://www.google.ms
O1 - Hosts: 66.180.173.39 http://www.google.mu
O1 - Hosts: 66.180.173.39 http://www.google.mw
O1 - Hosts: 66.180.173.39 http://www.google.nl
O1 - Hosts: 66.180.173.39 http://www.google.no
O1 - Hosts: 66.180.173.39 http://www.google.off.ai
O1 - Hosts: 66.180.173.39 http://www.google.pl
O1 - Hosts: 66.180.173.39 http://www.google.pn
O1 - Hosts: 66.180.173.39 http://www.google.pt
O1 - Hosts: 66.180.173.39 http://www.google.ro
O1 - Hosts: 66.180.173.39 http://www.google.ru
O1 - Hosts: 66.180.173.39 http://www.google.rw
O1 - Hosts: 66.180.173.39 http://www.google.se
O1 - Hosts: 66.180.173.39 http://www.google.sh
O1 - Hosts: 66.180.173.39 http://www.google.sk
O1 - Hosts: 66.180.173.39 http://www.google.sm
O1 - Hosts: 66.180.173.39 http://www.google.td
O1 - Hosts: 66.180.173.39 http://www.google.tm

O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\Alyssa\LOCALS~1\Temp\jenafcfspgx.dll
O2 - BHO: SDWin32 Class - {68E7A2A9-F198-4FA2-84A9-22E73F1FD264} - C:\WINDOWS\System32\lnilp.dll (file missing)
O2 - BHO: SDWin32 Class - {80CFA6CE-29E7-4AEB-B0D6-80E96DE2EF38} - C:\WINDOWS\System32\phfwy.dll (file missing)

O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [18i71lvt] C:\WINDOWS\System32\18i71lvt.exe
O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [apisvc.exe] C:\WINDOWS\System32\apisvc.exe
O4 - HKLM\..\Run: [secserv.exe] C:\WINDOWS\System32\secserv.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [dnam] C:\WINDOWS\system32\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\ddls4d.exe reg_run
O4 - HKCU\..\Run: [byr5RXGmh] umdax.exe
O4 - HKCU\..\Run: [Yofgpd] C:\WINDOWS\System32\l?ass.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe

O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\csutil.dll

Now, with all windows closed except HiJackThis, click "Fix checked".

===============

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Program Files\SurfSideKick 3

files...

C:\WINDOWS\System32\secserv.exe
C:\DOCUME~1\Alyssa\LOCALS~1\Temp\jenafcfspgx.dll
C:\WINDOWS\System32\PSof1.exe
C:\WINDOWS\System32\richup.exe
C:\WINDOWS\cfgmgr52.dll
C:\WINDOWS\System32\18i71lvt.exe
C:\WINDOWS\VCMnet11.exe
C:\WINDOWS\System32\apisvc.exe
C:\WINDOWS\system32\d140113.a.Stub.EXE
C:\WINDOWS\System32\ddls4d.exe
C:\WINDOWS\system32\csutil.dll

Search for...

AUNPS2.DLL
umdax.exe

...using "Start | Search...".

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them from "Safe Mode".

Launch Notepad, and copy the text in the box below into a new text file, save as

File name: Findfile.bat
Save as type: All files

Save it to your desktop

dir C:\WINDOWS\System32\l?ass.exe /a h > files.txt
notepad files.txt

Locate FindFile.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text in your reply

===============

Post back a new log, and let me know how everything goes.

-

Bertha

NonSuch

September 20, 2005, 3:42 AM UTC

Whilst we appreciate that you may be busy, it has been 14 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.