Author Topic: Greetings =)  (Read 15956 times)

0 Members and 1 Guest are viewing this topic.

April 25, 2008, 01:07:45 pm
Read 15956 times


  • Newbie

  • Offline
  • *

  • 2
Hey there people =) I'm new here(cred to drusepth for the reference) and just wanted to say you got a nice little forums here. We need more of these communities out there =) I'm in college studying software engineering and networking/web design, doing my first year exams atm.

Well, I'll get to the point now I guess. Somehow I picked up some sort of spyware/malware that is giving me a little trouble. I don't know too much about this type of threat(though I have spent over a week googling tuts and queries trying to figure it out) so I have decided to increase my chances of understanding it by asking the experts. Firstly, let me say that I am not here for a quick fix. I don't want you guys to just link me to an anti-spyware or anything like that. I just wanna post a highjackthis log if that's ok and I'd really appreciate any insight into why I have been unsuccessful so far in my attempts to remove this particular infection. From what I can tell with my limited knowledge, the infection is probably in my HKEY files somewhere, reseting my ie7 homepage or redirecting it. Either way, it causes my ie7 to open momentarily, but frequently. For the most part it is annoying and nothing more(minimizing fullscreen progs, like games/media players), but if i leave it for a prolonged length of time without taking action then it also causes my windows explorer to crash. Noticeably the processes iexplore.exe, iedw.exe and fksrzwxe.exe are affected(the last obviously being some sort of culprit, after finding no information on it, i took it off my machine but that hasn't solved my problem, just most likely will stop my os explorer from crashin again). Here's the log anyway, hopefully you guys might see something I missed.

Logfile of HijackThis v1.97.7
Scan saved at 13:11:18, on 25/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\PestPatrol\ppmcactivedetection.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Zenox Software\AppBlocker XP\AppBlocker XP.exe
C:\Program Files\HighjackThis\HijackThis.exe

R3 - Default URLSearchHook is missing
O1 - Hosts:
O1 - Hosts:
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (file missing)
O2 - BHO: (no name) - {6905911C-ADD2-5C9B-ABE9-06091A626707} - C:\WINDOWS\system32\nevnybn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {901D022C-F217-77D7-EA51-CB7880A5059A} - C:\DOCUME~1\BALROG~1\APPLIC~1\CAKEPH~1\LIVE PLUS.exe (file missing)
O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: (no name) - {F6E20ADE-8CE8-492c-BCBA-ABF3EF2DE4E8} - C:\Windows\system32\\msrdo20x26.dll
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [PPMCActiveDetection] C:\Program Files\Common Files\PestPatrol\ppmcactivedetection.exe "-ini:C:\Program Files\Common Files\PestPatrol\ppmcad.ini"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: FlashGet (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) -
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) -
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) -


Cheers in advance if anyone has any info, I'm running eTrust anti-virus realtime monitor, ad-aware anti-spyware, pestpatrol anti-spyware monitor and my router(NAT), still no joy.

April 25, 2008, 01:36:02 pm
Reply #1


  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
We don't (at least to my knowledge) provide support for infections here, but if I'm wrong I'm sure someone will correct me. The following do provide support though;

.... amongst others ....

In the meantime, your log clearly slows infections, and I'd strongly recommend you ditch eTrust as it's absolute rubbish same goes for PestPatrol). Get yourself one of the following instead;



NOD32 (my personal recommendation)

Steven Burn
I.T. Mate / hpHosts /

April 26, 2008, 01:29:32 am
Reply #2


  • Newbie

  • Offline
  • *

  • 2
My apologies, I didn't know that before making my post, my bad. Thank you all the same though for the links. A mate of mine actually works for eset and keeps telling me to get nod32 but I like my software because of the highly dynamic command line scanner. Either way, I'll probably get it when I finally decide to get rid of this infection, it was only because I had so much trouble with it that I was compelled to find out if anyone knew how it worked. Merely curious  ;)

Thanks for humoring me all the same  ;D

May 01, 2008, 12:21:42 pm
Reply #3


  • Special Members
  • Full Member

  • Offline
  • *

  • 57
  • Personal Text
Oh, my bad.  He asked me about his problem and I didn't know how to remove it so I referred him to the people I thought would.  ;)

I'll keep in mind the other sites that do provide the infection help from now on :)

May 02, 2008, 03:16:55 am
Reply #4


  • Special Members
  • Jr. Member

  • Offline
  • *

  • 32
    • TeMerc Internet Countermeasures
As an FYI, that version of HJT is way out of date, current versions accepted at all security forums:

Prefer 1.99.1 myself.

July 13, 2008, 12:23:34 am
Reply #5


  • Guest
in addition theres also seem to be having server issues currently), and there often overloaded with requests there, but good people

and my personal favorite

just follow the steps here
before you post your log

and yes update your hijackthis :)

July 13, 2008, 07:40:15 pm
Reply #6


  • Special Members
  • Sr. Member

  • Offline
  • *

  • 248
If you're still stuck on this, you can try:

It's a free online scanner. If you use it and find any bugs, please let me know.


July 14, 2008, 10:05:49 am
Reply #7


  • Special Members
  • Hero Member

  • Offline
  • *

  • 319
If you are after more private help and dont wanna install a thousand scanners and follow along in a forum type layout,just shoot me a email message,you can pm me for the correct address.   ;)

July 14, 2008, 12:39:11 pm
Reply #8


  • Guest
Rotflmao,what is everyone replying to here...
that's an infection that took place 2-3 months ago...  :D

July 14, 2008, 04:49:54 pm
Reply #9


  • Guest
My fault it looks like :p, it was on the first forum page :P, guess you guys aern't super busy :P