TheTechGuide Forum

General Category => Tech Clinic => Topic started by: Claire on February 02, 2007, 03:04:48 PM

Title: Need help with pornwebtv infection
Post by: Claire on February 02, 2007, 03:04:48 PM

Hello,

I am having problems with my computer. Some process I can not manage to locate and destroy is starting firefox and loading a pornweb TV page at random times. I also have usual malware problems, computer becomes very slow...

here is the hijack this logfile and uninstall list

Please help me

/unsure.gif\' class=\'bbc_emoticon\' alt=\':unsure:\' />

Kind regards
Claire

------------

Logfile of HijackThis v1.99.1
Scan saved at 20:28:42, on 02/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\TEMP\idd1A74.tmp.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\RAKOTO~1\LOCALS~1\Temp\RÃ©pertoire temporaire 1 pour hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ (http://\"http://www.google.fr/\")
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 (http://\"http://go.microsoft.com/fwlink/?LinkId=69157\")
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 (http://\"http://go.microsoft.com/fwlink/?LinkId=54896\")
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 (http://\"http://go.microsoft.com/fwlink/?LinkId=54896\")
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 (http://\"http://go.microsoft.com/fwlink/?LinkId=69157\")
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {65851057-219C-B66A-15FF-01D39E7B44CE} - C:\WINDOWS\system32\pxcghwj.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - C:\WINDOWS\system32\ixt0.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Auto EPSON Stylus CX3600 Series sur PORTABLE] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P44 "Auto EPSON Stylus CX3600 Series sur PORTABLE" /O22 "\\PORTABLE\Imprimante5" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Cammaestro 4.2GU build 1104.72
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [odfohcc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\odfohcc.dll,klunok
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [gi1369147394] "C:\DOCUME~1\RAKOTO~1\LOCALS~1\Temp\gi37ADQ6.exe" /resume:"C:\DOCUME~1\RAKOTO~1\LOCALS~1\Temp\2C37ACK0" /exename:"C:\Documents and Settings\RAKOTONIMARO\Application Data\Mozilla\Firefox\Profiles\68vtg3zr.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\setup.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: CrÃ©er un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab (http://\"http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab\")
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winhdn32 - C:\WINDOWS\SYSTEM32\winhdn32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe

-----

Hijack this uninstall list:

ÂµTorrent
Acer eConsole
Acer eMode Management
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 9 ActiveX
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.0.9
Adobe Shockwave Player
Adobe Stock Photos 1.0
Amaya 9.53
Apple Software Update
ATI Display Driver
avast! Antivirus
Correctif pour Windows XP (KB893357)
Correctif pour Windows XP (KB914440)
Correctif Windows XP - KB867282
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB885884
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893086
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
EPSON CardMonitor
EPSON Copy Utility 3
EPSON Logiciel imprimante
EPSON PhotoQuicker3.5
EPSON PhotoStarter3.1
EPSON PRINT Image Framer Tool2.1
EPSON Scan
EPSON Smart Panel
EPSON Web-To-Page
ESCX3600 Guide de rÃ©f.
ESCX3600 Guide des logiciels
GTK+ 2.10.6-1 runtime environment
HardwareDetection
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
IKEA Home Planner Kitchen
iPAQ Download Agent
iTunes
J2SE Runtime Environment 5.0 Update 5
LEADTOOLS ePrint 5 Professional
Lecteur Windows Media 11
Livebox
MaxTV
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft ActiveSync 4.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Outlook 2002
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mise Ã jour de sÃ©curitÃ© pour Lecteur Windows Media (KB911564)
Mise Ã jour de sÃ©curitÃ© pour Lecteur Windows Media 10 (KB917734)
Mise Ã jour de sÃ©curitÃ© pour Lecteur Windows Media 6.4 (KB925398)
Mise Ã jour de sÃ©curitÃ© pour Lecteur Windows Media 9 (KB917734)
Mise Ã jour de sÃ©curitÃ© pour Step by Step Interactive Training (KB898458)
Mise Ã jour de sÃ©curitÃ© pour Windows Internet Explorer 7 (KB929969)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB883939)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB890046)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB893756)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB896358)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB896422)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB896423)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB896424)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB896428)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB899587)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB899588)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB899591)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB900725)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB901017)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB901190)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB901214)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB902400)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB903235)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB904706)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB905414)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB905749)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB908519)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB911562)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB911567)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB911927)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB912919)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB913433)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB913580)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB914388)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB914389)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB917159)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB917344)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB917422)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB917953)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB918439)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB918899)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB919007)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB920213)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB920214)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB920670)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB920683)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB920685)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB921398)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB921883)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB922616)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB922760)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB922819)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB923191)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB923414)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB923689)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB923694)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB923980)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB924191)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB924270)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB924496)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB925486)
Mise Ã jour de sÃ©curitÃ© pour Windows XP (KB926255)
Mise Ã jour pour Windows XP (KB894391)
Mise Ã jour pour Windows XP (KB896727)
Mise Ã jour pour Windows XP (KB898461)
Mise Ã jour pour Windows XP (KB900485)
Mise Ã jour pour Windows XP (KB904942)
Mise Ã jour pour Windows XP (KB908531)
Mise Ã jour pour Windows XP (KB910437)
Mise Ã jour pour Windows XP (KB911280)
Mise Ã jour pour Windows XP (KB916595)
Mise Ã jour pour Windows XP (KB920872)
Mise Ã jour pour Windows XP (KB922582)
Mozilla Firefox (1.5.0.9)
Mozilla Thunderbird (1.5)
MSN
MSXML 4.0 SP2 (KB927978)
NTI Backup NOW! 4
NTI CD & DVD-Maker
NTI HomeVideo-Maker
OpenOffice.org 2.0
PDAmill EZ Note for Pocket PC
PIF DESIGNER2.1
PowerDVD
QuickTime
RealPlayer
Realtek High Definition Audio Driver
Sagem - Utilitaire rÃ©seau pour ClÃ© USB Wi-Fi 802.11g
ScanToWeb
SlovoEd 2005 pour PocketPC
The GIMP 2.2.13
VMware Player
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB894476
Windows Media Player 11
Yahoo! Messenger
Zylom Games Player Plugin

Title: Need help with pornwebtv infection
Post by: guestolo on February 04, 2007, 12:32:36 PM

Sorry for the delay, can you do the following please
We need a few tools, also, I need you to redownload Hijackthis
REDownload Hijackthis 1.99.1 from my signature below
SAVE it to your desktop

Double click on hijackthis_sfx.exe on desktop
Click the UNZIP button>>OK the prompt
This will self extract to C:\Program Files\HijackThis
Delete hijackthis_sfx.exe from desktop

Go to START>>RUN
Copy>>paste the following to the open field, then hit OK
%systemdrive%\Program Files\HijackThis
This will open the Hijackthis folder
RIGHT CLICK on Hijackthis.exe and select SEND TO>>Desktop (create shortcut)
You can now run Hijackthis.exe from the new shortcut placed on your desktop

==Download the latest version of [color=\"red\"]SmitfraudFix[/color] (http://\"http://siri.urz.free.fr/Fix/SmitfraudFix.zip\")[/url] (by S!Ri)
Extract the contents (a folder named SmitfraudFix) to your Desktop.
We will need this later

====Download [color=\"#FF0000\"]ATF-Cleaner[/color] (http://\"http://www.atribune.org/ccount/click.php?id=1\") by Atribune.
Save it to your desktop
We'll need this later

==Download [color=\"#FF0000\"]AVG Anti-Spyware 7.5[/color] (http://\"http://www.ewido.net/en/download/\")

Save the installer to desktop
Double click the installer, select your language, and then select "OK"
Click NEXT>>>Select I Agree>>>NEXT>>>INSTALL
AVG will now install and afterwards click FINISH
AVG Anti-Spyware 7.5 should now Load
Click the Update tab at the top. Under Manual Update click Start update.
After the update finishes (the status bar at the bottom will display "Update successful")
Click on the Scanner tab at the top
Click the "Settings" tab and then change the recommended action under "How to Act" to Quarantine and ensure that "Automatically generate report after every scan" IS selected and
"Only if Threats are found" IS NOT selected

CLOSE AVG-Antispyware for now, as we will need it later

Print the rest of these instructions, or save them too a text file on desktop, it's important, as much of the instructions will be done without any browser windows open and in safe mode

Access your Add/Remove programs and remove
J2SE Runtime Environment 5.0 Update 5 <--It's an older version of Sun Java that is vulnerable to malware
We'll update it in a bit

Double click on the Hijackthis shortcut on the desktop to run it
Click the button labelled >>"Open Misc Tools Section"
Click >> "Delete a File on Reboot"
In the "File name" field, copy>>paste the bold line I have posted below

C:\WINDOWS\SYSTEM32\winhdn32.dll

Then click the OPEN button
Hijackthis should prompt that the file will be deleted when Windows restarts
and you must restart your computer
Select NO at the prompt to restart now

Select "BACK" under 'other stuff' in Hijackthis
Click the Scan button

Put a check next to these entries:

O2 - BHO: (no name) - {65851057-219C-B66A-15FF-01D39E7B44CE} - C:\WINDOWS\system32\pxcghwj.dll
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - C:\WINDOWS\system32\ixt0.dll (file missing)
O4 - HKLM\..\Run: [odfohcc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\odfohcc.dll,klunok

O4 - HKCU\..\RunOnce: [gi1369147394] "C:\DOCUME~1\RAKOTO~1\LOCALS~1\Temp\gi37ADQ6.exe" /resume:"C:\DOCUME~1\RAKOTO~1\LOCALS~1\Temp\2C37ACK0" /exename:"C:\Documents and Settings\RAKOTONIMARO\Application Data\Mozilla\Firefox\Profiles\68vtg3zr.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\setup.exe"
O20 - Winlogon Notify: winhdn32 - C:\WINDOWS\SYSTEM32\winhdn32.dll

After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

============================================
==Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Firefox
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
==================================================

==Open the SmitfraudFix folder you extracted to desktop earlier

Double-click smitfraudfix.cmd
Press any key to continue
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process. A text file will appear onscreen, with results from the cleaning process
I'll need to see these later, by default they are also saved at C:\rapport.txt

If a reboot was not required, remain in safe mode
If a reboot was required, reboot back to safe mode please and follow the remaining instructions!!!!

Load AVG Anti-Spyware 7.5

Click on the Scanner tab at the top
Cick on Complete System Scan.
This scan can take a while to run, let it run uninterrupted
When the scan is complete it will list any infections found on the left hand side.
Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file (like on the Desktop).

I will need to see this log later

Restart the computer back to Normal windows
Back in Windows
Sun Java

Download the latest version of Java Runtime Environment (JRE) 6 (http://\"http://java.sun.com/javase/downloads/index.jsp\").
Scroll down to where it says "Java Runtime Enviroinment (JRE) 6, The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement[/i]".
The page will refresh.
Click on the link to download Windows Offline Installation, Multi-language and save it to your desktop (12.56 MB).

Double click on the installer on desktop, follow the instructions for installation
Once installed you can delete the installer from desktop

Even if it takes more than one reply to do so
Post back all the following
1. Post a fresh hijackthis log
2. Post the Whole report from AVG-Antispyware
3. Post the log from Smitfraudfix, located here>>C:\Rapport.txt

Title: Need help with pornwebtv infection
Post by: guestolo on February 11, 2007, 02:21:57 PM

Since there has been no reply, this topic is now locked

SMF 2.0.19 | SMF © 2021, Simple Machines | Terms and Policies