| Hi,
Thanks for getting back to me.,
I did as you suggested and here are the log files - which mean absolutely nothing to me!!!
irvy
[09/10/2006, 14:55:57] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Irene & John\My Documents\DOWNLOADS\VirtumundoBeGone.exe" )
[09/10/2006, 14:56:11] - Detected System Information:
[09/10/2006, 14:56:11] - Windows Version: 5.1.2600, Service Pack 2
[09/10/2006, 14:56:11] - Current Username: Irene & John (Admin)
[09/10/2006, 14:56:11] - Windows is in NORMAL mode.
[09/10/2006, 14:56:11] - Searching for Browser Helper Objects:
[09/10/2006, 14:56:11] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[09/10/2006, 14:56:11] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[09/10/2006, 14:56:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/10/2006, 14:56:11] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[09/10/2006, 14:56:11] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[09/10/2006, 14:56:11] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[09/10/2006, 14:56:11] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[09/10/2006, 14:56:11] - BHO 5: {D6A5DB0C-643C-4053-B290-AA421049594B} ()
[09/10/2006, 14:56:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/10/2006, 14:56:11] - Checking for HKLM\...\Winlogon\Notify\jkhfc
[09/10/2006, 14:56:11] - Found: HKLM\...\Winlogon\Notify\jkhfc - This is probably Virtumundo.
[09/10/2006, 14:56:11] - Assigning {D6A5DB0C-643C-4053-B290-AA421049594B} MSEvents Object
[09/10/2006, 14:56:11] - BHO list has been changed! Starting over...
[09/10/2006, 14:56:11] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[09/10/2006, 14:56:11] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[09/10/2006, 14:56:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/10/2006, 14:56:11] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[09/10/2006, 14:56:11] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[09/10/2006, 14:56:11] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[09/10/2006, 14:56:11] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[09/10/2006, 14:56:11] - BHO 5: {D6A5DB0C-643C-4053-B290-AA421049594B} (MSEvents Object)
[09/10/2006, 14:56:11] - ALERT: Found MSEvents Object!
[09/10/2006, 14:56:11] - Finished Searching Browser Helper Objects
[09/10/2006, 14:56:11] - *** Detected MSEvents Object
[09/10/2006, 14:56:11] - Trying to remove MSEvents Object...
[09/10/2006, 14:56:12] - Terminating Process: IEXPLORE.EXE
[09/10/2006, 14:56:12] - Terminating Process: RUNDLL32.EXE
[09/10/2006, 14:56:12] - Disabling Automatic Shell Restart
[09/10/2006, 14:56:12] - Terminating Process: EXPLORER.EXE
[09/10/2006, 14:56:12] - Suspending the NT Session Manager System Service
[09/10/2006, 14:56:12] - Terminating Windows NT Logon/Logoff Manager
[09/10/2006, 14:56:12] - Re-enabling Automatic Shell Restart
[09/10/2006, 14:56:12] - File to disable: C:\WINDOWS\system32\jkhfc.dll
[09/10/2006, 14:56:12] - Renaming C:\WINDOWS\system32\jkhfc.dll -> C:\WINDOWS\system32\jkhfc.dll.vir
[09/10/2006, 14:56:13] - File successfully renamed!
[09/10/2006, 14:56:13] - Removing HKLM\...\Browser Helper Objects\{D6A5DB0C-643C-4053-B290-AA421049594B}
[09/10/2006, 14:56:13] - Removing HKCR\CLSID\{D6A5DB0C-643C-4053-B290-AA421049594B}
[09/10/2006, 14:56:13] - Adding Kill Bit for ActiveX for GUID: {D6A5DB0C-643C-4053-B290-AA421049594B}
[09/10/2006, 14:56:13] - Deleting ATLEvents/MSEvents Registry entries
[09/10/2006, 14:56:13] - Removing HKLM\...\Winlogon\Notify\jkhfc
[09/10/2006, 14:56:13] - Searching for Browser Helper Objects:
[09/10/2006, 14:56:13] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[09/10/2006, 14:56:13] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[09/10/2006, 14:56:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/10/2006, 14:56:13] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[09/10/2006, 14:56:13] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[09/10/2006, 14:56:13] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[09/10/2006, 14:56:13] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[09/10/2006, 14:56:13] - Finished Searching Browser Helper Objects
[09/10/2006, 14:56:13] - Finishing up...
[09/10/2006, 14:56:13] - A restart is needed.
[09/10/2006, 14:56:29] - Attempting to Restart via STOP error (Blue Screen!)
Logfile of HijackThis v1.99.1
Scan saved at 15:01:37, on 10/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\MICROS~1\rapimgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.targa.co.uk/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KLO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.targa.co.uk/ O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.co.uk/SnapfishUKActivia.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1115426152062O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151267868812O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cabO16 - DPF: {DBFECB3F-B78F-442E-AE46-4952E6F17545} (Bonusprint Image Uploader Version 3.5) - http://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader3.cabO16 - DPF: {FB90BA05-66E6-4C56-BCD3-D65B0F7EBA39} (Foto.com SpeedUploader 1.0 Control) - http://express.foto.com/SFUploader/SpeedUploader.cabO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: winjyp32 - winjyp32.dll (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe O23 - Service: Sandra Data Service (SandraDataSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
SmitFraudFix v2.85
Scan done at 13:49:40.28, 10/09/2006
Run from
C:\Documents and Settings\Irene & John\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\IRENE
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Incident Status Location
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@247realmedia[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@ad.yieldmanager[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@atdmt[2].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@doubleclick[1].txt Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@fastclick[2].txt Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@hitbox[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@mediaplex[1].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@statcounter[1].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@stats1.reliablestats[1].txt Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@toplist[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@tribalfusion[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Irene & John\Cookies\irene & john@xiti[1].txt Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Irene & John\Desktop\SmitfraudFix\Process.exe Adware:Adware/AdvertMem Not disinfected C:\Documents and Settings\Irene & John\Incomplete\T-512213-_better version_ oh its such a perfect day 44.rar[setup.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Irene & John\My Documents\DOWNLOADS\SmitfraudFix.zip[SmitfraudFix/Process.exe] | 
