Jump to content

christopher HijackThis Log 02

christopher
 Share

Recommended Posts

christopher

christopher

Posted
Posted

alright.. many months later.. new ie explorer, sp2 and all..

all previous fixes were made, now i'm getting these popups whenever i go to any website that open in a new browser window (not tabbed) -- just by coming here i get a random popup.. something to clean my computer, or cell phone ringtones and so forth..

i've run everything, adaware, and everything provided in the malware prevention package from tarun's site.. still no stoppage.

here is my new hijackthis logfile if it helps

Logfile of HijackThis v1.99.1

Scan saved at 5:45:46 PM, on 2/5/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Yahoo!\Antivirus\ISafe.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exe

C:\Program Files\Yahoo!\Antivirus\VetMsg.exe

C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe

C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\System32\ezSP_Px.exe

C:\PROGRA~1\Yahoo!\YOP\yop.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

C:\Program Files\AIM95\aim.exe

C:\PROGRA~1\Yahoo!\browser\ycommon.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\christopher\Desktop\c\Anti-Malware Full\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe

O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"

O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [hgkudpg.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\christopher\Local Settings\Application Data\hgkudpg.dll",qoavije

O4 - HKLM\..\RunOnce: [spybotDeletingA8428] command /c del "C:\WINDOWS\system32\vqmvywlq.dll_tobedeleted_old"

O4 - HKLM\..\RunOnce: [spybotDeletingC5191] cmd /c del "C:\WINDOWS\system32\vqmvywlq.dll_tobedeleted_old"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl

O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe

O4 - HKCU\..\RunOnce: [spybotDeletingB5581] command /c del "C:\WINDOWS\system32\vqmvywlq.dll_tobedeleted_old"

O4 - HKCU\..\RunOnce: [spybotDeletingD6738] cmd /c del "C:\WINDOWS\system32\vqmvywlq.dll_tobedeleted_old"

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161395254515

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161395242343

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (Application) (file missing)

O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)

O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe

O23 - Service: VAIO Media Photo Server (Application) (VAIOMediaPlatform-PhotoServer-AppServer) - Unknown owner - C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exe

O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)

O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe

O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe

Link to comment
Share on other sites

Tarun

Tarun

Posted
Posted
O4 - HKLM\..\Run: [hgkudpg.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\christopher\Local Settings\Application Data\hgkudpg.dll",qoavije

This is the source of your problem. You can navigate to C:\Documents and Settings\christopher\Local Settings\Application Data\ and locate hgkudpg.dll. Attempt to delete the file manually. If you can not, use Unlocker to delete the file.

I also split your topic to help avoid some confusion since this is a new HijackThis log for a separate problem. :)

Link to comment
Share on other sites
LeveL

LeveL

Posted
Posted (edited)

You can submit your log files here:

http://www.hijackthis.de

For C:\Program Files\Yahoo!\Antivirus\VetMsg.exe it says...

Possibly nasty! According to our database this process runs normally

in c:\programme\ca.*\ Check if you know this process and arrange

a viruscheck where required.

Well, that seems pretty nonsensical to me, you can upload any file

you think is suspicious to http://www.virustotal.com/en/indexf.html

Edited by LeveL
Link to comment
Share on other sites
christopher

christopher

Posted
  • Author
Posted
O4 - HKLM\..\Run: [hgkudpg.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\christopher\Local Settings\Application Data\hgkudpg.dll",qoavije

This is the source of your problem. You can navigate to C:\Documents and Settings\christopher\Local Settings\Application Data\ and locate hgkudpg.dll. Attempt to delete the file manually. If you can not, use Unlocker to delete the file.

I also split your topic to help avoid some confusion since this is a new HijackThis log for a separate problem. :)

thanks. i dont like clutter much myself so i just kept my post in the previous one just in case.

i actually CAN'T navigate to where you're directing me above.

i can go to C: documents & settings, christopher, then the next step is local settings and i dont have it there.

so anyways, i just ran hijackthis again and did the whole 'fix' function on that hgkudpg.dll there. does this solve the problem just as well?

also, as someone stated above about something putting it there, is that what i have to go after? (and how)

Link to comment
Share on other sites
Tarun

Tarun

Posted
Posted
thanks. i dont like clutter much myself so i just kept my post in the previous one just in case.

i actually CAN'T navigate to where you're directing me above.

i can go to C: documents & settings, christopher, then the next step is local settings and i dont have it there.

so anyways, i just ran hijackthis again and did the whole 'fix' function on that hgkudpg.dll there. does this solve the problem just as well?

also, as someone stated above about something putting it there, is that what i have to go after? (and how)

The folder may be hidden. You can also access it through the command prompt or using FileASSASSIN (you can paste the path into it.)

It's possible the parent program may already have been deleted with the scans prior to your log submission. Here's the link to FileMon.

Link to comment
Share on other sites
christopher

christopher

Posted
  • Author
Posted
FileMon (File Monitor)

You simply removed the run entry with HijackThis, the file still exists.

so does this filemon do anything when it's running? currently i have it running and it's just flying through a zillion files.

what's the purpose of me having it?

do i have this so i can find hgkudpg.dll?

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...