Please Help! - Windows Explorer - Microsoft XP Microborg Edition

[Broni]

you will find a log in C:\Program Files\esetonlinescanner\log.txt

[omg_i_need_help]

The Log


# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2806 (20080118)
# vers_arch_module=1.063 (20080117)
# vers_adv_heur_module=1.060 (20070601)
# EOSSerial=6b7275a0b674b74db35b5e8760bf7d80
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-01-19 11:21:16
# local_time=2008-01-19 04:21:16 (-0700, Mountain Standard Time)
# country="United Kingdom"
# osver=5.1.2600 NT Service Pack 2
# scanned=203829
# found=7
# scan_time=6106
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4VOPALU5\nn[1].exe   multiple infiltrations   C7BB2AF13C5B2D4A0BCD11753C729DD3
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4VOPALU5\nn[1].exe »RAR »helper.exe   probably unknown NewHeur_PE virus   00000000000000000000000000000000
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4VOPALU5\nn[1].exe »RAR »relpk.exe   probably a variant of Win32/TrojanProxy.Ranky trojan   00000000000000000000000000000000
C:\Serials and cracks\Crack Searchers.rar   Win32/Adware.Craagle application   F95FF9774DCB7C3FD578EE43D18CFAB4
C:\Serials and cracks\Crack Searchers.rar »RAR »Crack Searchers\craagle1.91\Craagle.exe   Win32/Adware.Craagle application   00000000000000000000000000000000
C:\WINDOWS\system32\iifgged.dll   Win32/Adware.Virtumonde application   C0DB659272F997D3D03EA9520ADE5BC1
C:\WINDOWS\system32\ljjjggf.dll   Win32/Adware.Virtumonde application   C0DB659272F997D3D03EA9520ADE5BC1

[omg_i_need_help]

Now HJT?

[Broni]

Yes, please.

[omg_i_need_help]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:32:11, on 19/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\TASKILL.exe
C:\WINDOWS\huzi.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MicroBorg Internet Exploder
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhee.exe
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Stat Bar 2.46.lnk = C:\StatBar.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{040BB65D-EF2A-4A82-A339-14DB0AFE5735}: NameServer = 212.139.132.23 212.139.132.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{040BB65D-EF2A-4A82-A339-14DB0AFE5735}: NameServer = 212.139.132.23 212.139.132.22
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

--
End of file - 5374 bytes

[omg_i_need_help]

"huzi.exe" is "explorer.exe" copied and renamed so what ever is closing explorer.exe cant close huzi.exe.

get me ?

[Broni]

Yep.

[omg_i_need_help]

Any ideas?

[Broni]

* I can't see any firewall running, unless you're using Windows firewall?

* You need to update your Java: http://www.java.com/en/download/index.jsp

* Go Start>Control Panel>Add\Remove, and uninstall Bearshare (if present).

Now...

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries:

- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

- F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhee.exe

- O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)

4. Click on "Fix checked" button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders".

7. Delete following files/folders (if present):

- jkhee.exe from C:\WINDOWS\system32

8. Turn off System Restore:

- Windows XP:
   1. Click Start.
   2. Right-click the My Computer icon, and then click Properties.
   3. Click the System Restore tab.
   4. Check "Turn off System Restore".
   5. Click Apply.   
   6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
   7. Click OK.
- Windows Vista:
   1. Click Start.
   2. Right-click the Computer icon, and then click Properties.
   3. Click on System Protection under the Tasks column on the left side
   4. Click on Continue on the "User Account Control" window that pops up
   5. Under the System Protection tab, find Available Disks
   6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
   7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
   8. Click OK

9. Restart in Normal Mode.

10. Turn System Restore on.

11. Post new HijackThis log.

[Broni]

Any ideas?

No pushing. There is no rush, when dealing with malwares.

[omg_i_need_help]

Just rebooted in Safe Mode, When the logon screen appeared the laptop restarted it's self I still have no taskbar.

File "C:\WINDOWS\System32\jkhee.exe" has the exact name "jkhee.dll". I'm guessing thats accociated. Anything I can do? lol

[omg_i_need_help]

Ok, i found this at the bottom of "jkhee.dll"

Code: [Select]

CharUpperA  @ CopyRect  E CreateCursor  R CreateMenu  „ DestroyCursor Œ DispatchMessageA  ” DrawStateA  user32.dll   CompareStringA  n EnumResourceLanguagesA  € ExitProcess ? ExitThread  õ GetFileSize ż GetLastError  
GetPrivateProfileStringA  @
GetSystemTime Ź
OpenFile  `Sleep wUnmapViewOfFile ƒVirtualFree µlstrcatA  ·lstrcmpA  ¹lstrcmpiA »lstrcpyA  ælstrlenA  kernel32.dll
That tells me its playing with my Kernel file, Cant that cause some major damage ?

[Broni]

Did you try to delete jkhee.exe file?

i found this at the bottom of "jkhee.dll"

What do you mean by "at the bottom"?