Newbie dot Org HomePage
Visit one of our web buddies
Cant beat this virus /pop up / spyware
joey r
futurepr@optonline.net
06/26/04
tried alot of differnt stuff to eliminate this nast sucker in my laptop...
but to no avail...

here the hijack this output...
looks pretty gruesome doesnt it....

thanks in advance for any advice and assistance.

j.

Logfile of HijackThis v1.97.7
Scan saved at 8:05:39 AM, on 6/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\sony\giga pocket\shwserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\ntus32.exe
C:\WINDOWS\system32\crep.exe
C:\Program Files\Sony\giga pocket\RM_SV.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe
C:\WINDOWS\System32\ICO.EXE
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\program files\support.com\client\bin\tgcmd.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Sony\USBSircs\usbsircs.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\compusa\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fxgvi.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://fxgvi.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://fxgvi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fxgvi.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://fxgvi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\fxgvi.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = www.yahoo.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C397BB2-36D2-F787-9AA2-DB56173763F4} - C:\WINDOWS\msaz.dll
O2 - BHO: (no name) - {C7739568-F83A-1E0D-AC44-FF449FEFF4B2} - C:\WINDOWS\system32\msne.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [VAIO Recovery] C:\Windows\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [crep.exe] C:\WINDOWS\system32\crep.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\RunOnce: [ntus32.exe] C:\WINDOWS\ntus32.exe
O4 - HKLM\..\RunOnce: [addlt.exe] C:\WINDOWS\addlt.exe
O4 - HKLM\..\RunOnce: [ierh.exe] C:\WINDOWS\ierh.exe
O4 - HKLM\..\RunOnce: [ipcu.exe] C:\WINDOWS\ipcu.exe
O4 - HKLM\..\RunOnce: [crjm.exe] C:\WINDOWS\system32\crjm.exe
O4 - HKLM\..\RunOnce: [sdkst.exe] C:\WINDOWS\sdkst.exe
O4 - HKLM\..\RunOnce: [atlfh.exe] C:\WINDOWS\atlfh.exe
O4 - HKLM\..\RunOnce: [sdklk.exe] C:\WINDOWS\sdklk.exe
O4 - HKLM\..\RunOnce: [apitc32.exe] C:\WINDOWS\system32\apitc32.exe
O4 - HKLM\..\RunOnce: [winan.exe] C:\WINDOWS\winan.exe
O4 - HKLM\..\RunOnce: [sdkme32.exe] C:\WINDOWS\sdkme32.exe
O4 - HKLM\..\RunOnce: [sysdy.exe] C:\WINDOWS\system32\sysdy.exe
O4 - HKLM\..\RunOnce: [addav32.exe] C:\WINDOWS\addav32.exe
O4 - HKLM\..\RunOnce: [apisp32.exe] C:\WINDOWS\apisp32.exe
O4 - HKLM\..\RunOnce: [ipaa32.exe] C:\WINDOWS\system32\ipaa32.exe
O4 - HKLM\..\RunOnce: [d3jl32.exe] C:\WINDOWS\system32\d3jl32.exe
O4 - HKLM\..\RunOnce: [winuz.exe] C:\WINDOWS\winuz.exe
O4 - HKLM\..\RunOnce: [appsb.exe] C:\WINDOWS\appsb.exe
O4 - HKLM\..\RunOnce: [d3ry.exe] C:\WINDOWS\d3ry.exe
O4 - HKLM\..\RunOnce: [syscx.exe] C:\WINDOWS\syscx.exe
O4 - HKLM\..\RunOnce: [mfccq32.exe] C:\WINDOWS\mfccq32.exe
O4 - HKLM\..\RunOnce: [ipwc32.exe] C:\WINDOWS\ipwc32.exe
O4 - HKLM\..\RunOnce: [crre32.exe] C:\WINDOWS\crre32.exe
O4 - HKLM\..\RunOnce: [d3ks.exe] C:\WINDOWS\d3ks.exe
O4 - HKLM\..\RunOnce: [ippb32.exe] C:\WINDOWS\ippb32.exe
O4 - HKLM\..\RunOnce: [iphd.exe] C:\WINDOWS\iphd.exe
O4 - HKLM\..\RunOnce: [winnh.exe] C:\WINDOWS\winnh.exe
O4 - HKLM\..\RunOnce: [apiqf32.exe] C:\WINDOWS\apiqf32.exe
O4 - HKLM\..\RunOnce: [atltj.exe] C:\WINDOWS\system32\atltj.exe
O4 - HKLM\..\RunOnce: [sdkus32.exe] C:\WINDOWS\sdkus32.exe
O4 - HKLM\..\RunOnce: [ntxo32.exe] C:\WINDOWS\system32\ntxo32.exe
O4 - HKLM\..\RunOnce: [netro32.exe] C:\WINDOWS\system32\netro32.exe
O4 - HKLM\..\RunOnce: [javasd.exe] C:\WINDOWS\javasd.exe
O4 - HKLM\..\RunOnce: [ipjb32.exe] C:\WINDOWS\system32\ipjb32.exe
O4 - HKLM\..\RunOnce: [msiq32.exe] C:\WINDOWS\msiq32.exe
O4 - HKLM\..\RunOnce: [ipjo32.exe] C:\WINDOWS\system32\ipjo32.exe
O4 - HKLM\..\RunOnce: [sdknm.exe] C:\WINDOWS\sdknm.exe
O4 - HKLM\..\RunOnce: [sdkkt.exe] C:\WINDOWS\system32\sdkkt.exe
O4 - HKLM\..\RunOnce: [crfi32.exe] C:\WINDOWS\crfi32.exe
O4 - HKLM\..\RunOnce: [crew32.exe] C:\WINDOWS\system32\crew32.exe
O4 - HKLM\..\RunOnce: [mfcyh32.exe] C:\WINDOWS\system32\mfcyh32.exe
O4 - HKLM\..\RunOnce: [appme32.exe] C:\WINDOWS\system32\appme32.exe
O4 - HKLM\..\RunOnce: [atlqr.exe] C:\WINDOWS\atlqr.exe
O4 - HKLM\..\RunOnce: [addvc32.exe] C:\WINDOWS\addvc32.exe
O4 - HKLM\..\RunOnce: [ient32.exe] C:\WINDOWS\system32\ient32.exe
O4 - HKLM\..\RunOnce: [msgm.exe] C:\WINDOWS\system32\msgm.exe
O4 - HKLM\..\RunOnce: [sysnm32.exe] C:\WINDOWS\system32\sysnm32.exe
O4 - HKLM\..\RunOnce: [sysql32.exe] C:\WINDOWS\sysql32.exe
O4 - HKLM\..\RunOnce: [sdktd.exe] C:\WINDOWS\sdktd.exe
O4 - HKLM\..\RunOnce: [sysdh32.exe] C:\WINDOWS\sysdh32.exe
O4 - HKLM\..\RunOnce: [mfcan32.exe] C:\WINDOWS\mfcan32.exe
O4 - HKLM\..\RunOnce: [mfcnr.exe] C:\WINDOWS\system32\mfcnr.exe
O4 - HKLM\..\RunOnce: [apipj.exe] C:\WINDOWS\apipj.exe
O4 - HKLM\..\RunOnce: [apisx32.exe] C:\WINDOWS\apisx32.exe
O4 - HKLM\..\RunOnce: [atlsl.exe] C:\WINDOWS\system32\atlsl.exe
O4 - HKLM\..\RunOnce: [ipuj32.exe] C:\WINDOWS\system32\ipuj32.exe
O4 - HKLM\..\RunOnce: [apiwj.exe] C:\WINDOWS\apiwj.exe
O4 - HKLM\..\RunOnce: [sysxq.exe] C:\WINDOWS\system32\sysxq.exe
O4 - HKLM\..\RunOnce: [crtb32.exe] C:\WINDOWS\system32\crtb32.exe
O4 - HKLM\..\RunOnce: [addkg.exe] C:\WINDOWS\system32\addkg.exe
O4 - HKLM\..\RunOnce: [mswi32.exe] C:\WINDOWS\system32\mswi32.exe
O4 - HKLM\..\RunOnce: [winqh32.exe] C:\WINDOWS\winqh32.exe
O4 - HKLM\..\RunOnce: [d3bd.exe] C:\WINDOWS\d3bd.exe
O4 - HKLM\..\RunOnce: [sysal.exe] C:\WINDOWS\system32\sysal.exe
O4 - HKLM\..\RunOnce: [addwr32.exe] C:\WINDOWS\addwr32.exe
O4 - HKLM\..\RunOnce: [winhw32.exe] C:\WINDOWS\system32\winhw32.exe
O4 - HKLM\..\RunOnce: [sdkzg.exe] C:\WINDOWS\sdkzg.exe
O4 - HKLM\..\RunOnce: [apixz32.exe] C:\WINDOWS\apixz32.exe
O4 - HKLM\..\RunOnce: [ntvl32.exe] C:\WINDOWS\ntvl32.exe
O4 - HKLM\..\RunOnce: [crfz.exe] C:\WINDOWS\system32\crfz.exe
O4 - HKLM\..\RunOnce: [ipca32.exe] C:\WINDOWS\system32\ipca32.exe
O4 - HKLM\..\RunOnce: [appyw.exe] C:\WINDOWS\system32\appyw.exe
O4 - HKLM\..\RunOnce: [javaks32.exe] C:\WINDOWS\javaks32.exe
O4 - HKLM\..\RunOnce: [addbq.exe] C:\WINDOWS\system32\addbq.exe
O4 - HKLM\..\RunOnce: [syswa.exe] C:\WINDOWS\system32\syswa.exe
O4 - HKLM\..\RunOnce: [mfcra.exe] C:\WINDOWS\system32\mfcra.exe
O4 - HKLM\..\RunOnce: [crek.exe] C:\WINDOWS\crek.exe
O4 - HKLM\..\RunOnce: [mfcno.exe] C:\WINDOWS\system32\mfcno.exe
O4 - HKLM\..\RunOnce: [ntdb32.exe] C:\WINDOWS\system32\ntdb32.exe
O4 - HKLM\..\RunOnce: [addam32.exe] C:\WINDOWS\addam32.exe
O4 - HKLM\..\RunOnce: [ieos32.exe] C:\WINDOWS\system32\ieos32.exe
O4 - HKLM\..\RunOnce: [ipbg32.exe] C:\WINDOWS\ipbg32.exe
O4 - HKLM\..\RunOnce: [winod32.exe] C:\WINDOWS\winod32.exe
O4 - HKLM\..\RunOnce: [apisf32.exe] C:\WINDOWS\apisf32.exe
O4 - HKLM\..\RunOnce: [ipcs.exe] C:\WINDOWS\ipcs.exe
O4 - HKLM\..\RunOnce: [netkn32.exe] C:\WINDOWS\netkn32.exe
O4 - HKLM\..\RunOnce: [javaau.exe] C:\WINDOWS\javaau.exe
O4 - HKLM\..\RunOnce: [atllx.exe] C:\WINDOWS\system32\atllx.exe
O4 - HKLM\..\RunOnce: [ntet32.exe] C:\WINDOWS\ntet32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\Quicken\billmind.exe
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\Quicken\QWDLLS.EXE
O4 - Global Startup: Remocon Driver.lnk = ?
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad (HKLM)
O9 - Extra 'Tools' menuitem: Control Pad (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.com/cab/ImageViewer/MFImgVwr.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38139.5560300926

Browser: IE 6
OS: xp


© Copyright 1998-2004 Newbie dot Org -- All rights reserved --



This site maintained by Galaxy Website Design


--|--