Member Avatar for SuperSam

Logfile of HijackThis v1.99.1
Scan saved at 8:52:16 PM, on 3/4/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BellSouth Accelerator Technology\propelac.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Bellsouth Telecommunications, Inc\Internet Call Waiting\Icw.exe
C:\Program Files\Bellsouth Telecommunications, Inc\Internet Call Waiting\IsRasConnected.exe
C:\Documents and Settings\Owner\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINDOWS\xml2lib.dll (file missing)
O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\winadvt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Propel Accelerator] "C:\Program Files\BellSouth Accelerator Technology\trayctl.exe" /STARTUPLAUNCH
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SMSSU] C:\WINDOWS\System32\SMSSU.EXE
O4 - HKCU\..\Run: [Tmntsrv32] C:\WINDOWS\System32\Tmntsrv32.EXE
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Win32res] C:\WINDOWS\win32res.exe
O4 - Global Startup: ICW - Internet Call Waiting.lnk = C:\Program Files\Bellsouth Telecommunications, Inc\Internet Call Waiting\Icw.exe
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\BellSouth Accelerator Technology\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\BellSouth Accelerator Technology\pac-image.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {01118A01-3E00-11D2-8470-0060089874ED} (SupportSoft Script Runner Class) -
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - ?
O17 - HKLM\System\CCS\Services\Tcpip\..\{9589870E-D45F-4D8E-B99E-77161D1F2FC7}: NameServer =
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

  • 3 Contributors
  • 4 Replies
  • 113 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by SuperSam

Dani AI

Generated

This thread is a classic example of a browser-redirect/fraudtool infection and a good troubleshooting flow. and correctly interpreted the symptoms shown in the HijackThis output, and reports the machine was cleaned with a dedicated removal utility (with help from @NoFearAHD). For anyone who finds this later, the following concise, practical follow‑up checklist helps verify the system is truly clean and harden it against recurrence.

After a removal tool reports success, keep the PC offline and back up only personal data (no EXEs or installers). Run at least one full, up‑to‑date on‑demand anti‑malware scan and, if possible, a rescue‑disk scan to catch anything hidden while Windows is running. Inspect startup points, scheduled tasks, services, drivers and network layers for stray or unknown entries; do not re-enable items you do not recognize. Verify browser settings (home page, proxy, add‑ons) have been reset and check the hosts file and router DNS for unexpected entries.

Once confident of cleanup, delete old System Restore checkpoints created while infected and create a fresh restore point. Fully apply Windows and browser security updates, then change all online passwords that were used from the infected machine. If reinfection, persistent unknown drivers/services, or suspicious network behavior (DNS changes, redirects) continue, a full OS reinstall is the safest option—these fraudtools sometimes leave deep hooks that are hard to remove completely.

Prevention notes: run day‑to‑day as a non‑admin user, keep OS and apps patched, run real‑time AV/anti‑malware, and maintain a verified image backup. If uncertainty remains, capture current logs (startup list/HijackThis) and seek expert review before restoring from backups or reconnecting the PC to the network.

Recommended Answers

All 4 Replies

Member Avatar for tayspen

Hi, The log indicates that you are running Service pack 1 (SP1). After the cleaning process it is highy recommended you download and install Service pack 2(SP2).Now boot into start HJT and have it fix the following.


O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINDOWS\xml2lib.dll (file missing)

O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\winadvt.dll

O4 - HKCU\..\Run: [SMSSU] C:\WINDOWS\System32\SMSSU.EXE

O4 - HKCU\..\Run: [Tmntsrv32] C:\WINDOWS\System32\Tmntsrv32.EXE

O4 - HKCU\..\Run: [Win32res] C:\WINDOWS\win32res.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - ?

This entry im not sure about.


O17 - HKLM\System\CCS\Services\Tcpip\..\{9589870E-D45F-4D8E-B99E-77161D1F2FC7}: NameServer =

Do your reconize the IP or anything about it? If not have HJT fix it.

Then boot back into "normal mode", and download ewido when installing uncheck Install guard and add context menu. Make sure its updated and run it. (Save the log)

Scan again with HJT, and post the new HJT log and the ewido log.

Member Avatar for 'Stein

Here we are:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINDOWS\xml2lib.dll (file missing)
O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\winadvt.dll
O4 - HKCU\..\Run: [SMSSU] C:\WINDOWS\System32\SMSSU.EXE
O4 - HKCU\..\Run: [Tmntsrv32] C:\WINDOWS\System32\Tmntsrv32.EXE
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {01118A01-3E00-11D2-8470-0060089874ED} (SupportSoft Script Runner Class) -
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - ?

Based on several entries, it is believed that you have a trojan: Trojan.StartPage.O
Help is here :

Thanks.

EDIT: Arrg, u win this one hahah.

Member Avatar for tayspen

Lol, well were even ;). Nice link though, good info.

Member Avatar for SuperSam

I got the virus. Its a smitfraud infection. I ran smitrem and it works fine. Thanks for your help guys and thank to NoFearAHD.

Sam.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.