found some virus on my computer, help (part 1)

[rafeena1]

Hi,

Please help again,

I am in the process of removing some virus from my computer and was advised to install Service Parck 1a for windows XP, which I did. I was then advised to download Vundo Fix; however, the program found no infected files. I later downloaed VirtumundoBeGone and ran another HijfackThis scan. I was told to re-post my finding so below are these findings.  I am new to forums and I receive notification indicating that my message was too long so i split it in two; I hope i am following the right procedures. Thanks a mil!

Here is what I found with VirtumundoBeGone Scan:



[07/28/2007, 17:47:52] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Jason Grefski\My Documents\VirtumundoBeGone.exe" )
[07/28/2007, 17:48:10] - Detected System Information:
[07/28/2007, 17:48:10] -  Windows Version: 5.1.2600,
[07/28/2007, 17:48:10] -  Current Username: Jason Grefski (Admin)
[07/28/2007, 17:48:10] -  Windows is in SAFE mode with Networking.
[07/28/2007, 17:48:10] - Searching for Browser Helper Objects:
[07/28/2007, 17:48:10] -  BHO 1: {26FD0383-8810-6B17-5EFB-22DA61DAB6BD} ()
[07/28/2007, 17:48:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/28/2007, 17:48:10] -  Checking for HKLM\...\Winlogon\Notify\pgpwsdhk
[07/28/2007, 17:48:10] -  Key not found: HKLM\...\Winlogon\Notify\pgpwsdhk, continuing.
[07/28/2007, 17:48:10] -  BHO 2: {9B1620DE-F835-7274-BCB0-17E839C0AECB} ()
[07/28/2007, 17:48:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/28/2007, 17:48:10] -  Checking for HKLM\...\Winlogon\Notify\eygdlfmr
[07/28/2007, 17:48:10] -  Key not found: HKLM\...\Winlogon\Notify\eygdlfmr, continuing.
[07/28/2007, 17:48:10] -  BHO 3: {DEA8140A-770B-1DB4-B7E7-9E992EFFCD06} ()
[07/28/2007, 17:48:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/28/2007, 17:48:10] -  Checking for HKLM\...\Winlogon\Notify\wgpfumyy
[07/28/2007, 17:48:10] -  Key not found: HKLM\...\Winlogon\Notify\wgpfumyy, continuing.
[07/28/2007, 17:48:10] - Finished Searching Browser Helper Objects
[07/28/2007, 17:48:10] - Finishing up...
[07/28/2007, 17:48:10] - Nothing found! Exiting...

[mycompisbroke]

You could of saved us the trouble of opening a 2nd topic by posting it in a reply to this one.

[rafeena1]

I apologize, I didn't know. Thanks!

[rafeena1]

Hi, this is a continuation of found some virus on my computer (part1 ).

Logfile of HijackThis v1.99.1
Scan saved at 5:57:43 PM, on 7/28/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\System32\confgldr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\winasp.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\vwgwrbds.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ojndgbtm.exe
C:\WINDOWS\System32\wumgr.exe
C:\Program Files\Common Files\AOL\1102561437\ee\AOLSoftware.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\Microsoft Office\Register\Remind32.exe
C:\Program Files\Microsoft Office\programs\alarm.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Microsoft Office\programs\dad9.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Netropa\OSD.exe
C:\WINDOWS\System32\wuauclt.exe
c:\program files\common files\aol\1102561437\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe
c:\program files\common files\aol\1102561437\ee\aolsoftware.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\Documents and Settings\Jason Grefski\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\logon.exe
O2 - BHO: (no name) - {26FD0383-8810-6B17-5EFB-22DA61DAB6BD} - C:\WINDOWS\System32\pgpwsdhk.dll
O2 - BHO: (no name) - {9B1620DE-F835-7274-BCB0-17E839C0AECB} - C:\WINDOWS\System32\eygdlfmr.dll
O2 - BHO: (no name) - {DEA8140A-770B-1DB4-B7E7-9E992EFFCD06} - C:\WINDOWS\System32\wgpfumyy.dll (file missing)
O4 - HKLM\..\Run: [Shell Logon] C:\logon.exe
O4 - HKLM\..\Run: [vwgwrbds] C:\WINDOWS\System32\vwgwrbds.exe
O4 - HKLM\..\Run: [Video Process] winasp.exe
O4 - HKLM\..\Run: [qyslqvcl] C:\WINDOWS\System32\qyslqvcl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ojndgbtm] C:\WINDOWS\System32\ojndgbtm.exe
O4 - HKLM\..\Run: [Microsoft Update Manager] wumgr.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1102561437\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [Com+ Sys] csrs.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Configuration Loader] confgldr.exe
O4 - HKLM\..\RunServices: [Configuration Loader] confgldr.exe
O4 - HKLM\..\RunServices: [Video Process] winasp.exe
O4 - HKLM\..\RunServices: [Com+ Sys] csrs.exe
O4 - HKLM\..\RunServices: [Microsoft Update Manager] wumgr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Update Manager] wumgr.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Microsoft Office\Register\Remind32.exe
O4 - Global Startup: CorelCENTRAL 9.LNK = C:\Program Files\Microsoft Office\programs\ccwin9.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Microsoft Office\programs\alarm.exe
O4 - Global Startup: Date Manager.lnk = C:\Program Files\Date Manager\DateManager.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Microsoft Office\programs\dad9.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Jason Grefski\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Jason Grefski\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {53A1630A-DB38-4316-B18F-911719E1F66E} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v11/ticker.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/23c1c0030ac94826fe15/netzip/RdxIE2.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1185654450389
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1185654429499
O16 - DPF: {7160FB1B-3DE0-4C42-81F0-41B4269990B0} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v12/ticker.cab
O16 - DPF: {B2FCED61-570E-11D3-B160-00A0C9E70E84} (OmniForm Form Control) - https://www4.lsac.org/lsacd_xmlwebservices/Http/OIFActiveX/ofmctl.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Configuration Loader - Unknown owner - C:\WINDOWS\System32\confgldr.exe" -service (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ritmtqunjmkh (MsUpdate6) - Unknown owner - C:\WINDOWS\System32\msupd6.exe (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Video Process - Unknown owner - C:\WINDOWS\System32\winasp.exe" -service (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[CBMatt]

Let's stick to the original thread.  I'm going to go ahead and lock this one.