i got a virus ... or maybe two ... help please! Options

[*basick*]

it looks like i got a virus and a trojan.. i tried searchin google for the solutions but the tutorials didn't work... norton antivirus is bein real gay right now... help anyone?

[ryanoman]

Please download HijackThis at download.com and post up a log. Also check out the link above.

Also check out this: http://www.createblog.com/forums/index.php...3&hl=smithfraud

[*basick*]

Please download HijackThis at download.com and post up a log. Also check out the link above.

<!-- begin code provided by createblog.com --><br />Logfile of HijackThis v1.99.1<br />Scan saved at 3:48:47 PM, on 6/16/2005<br />Platform: Windows XP SP1 (WinNT 5.01.2600)<br />MSIE: Unable to get Internet Explorer version!<br /><br />Running processes:<br />C:\WINDOWS\System32\smss.exe<br />C:\WINDOWS\system32\csrss.exe<br />C:\WINDOWS\system32\winlogon.exe<br />C:\WINDOWS\system32\services.exe<br />C:\WINDOWS\system32\lsass.exe<br />C:\WINDOWS\system32\svchost.exe<br />C:\WINDOWS\System32\svchost.exe<br />C:\WINDOWS\System32\svchost.exe<br />C:\WINDOWS\System32\svchost.exe<br />C:\WINDOWS\system32\spoolsv.exe<br />C:\WINDOWS\System32\alg.exe<br />C:\WINDOWS\System32\CTSvcCDA.EXE<br />C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE<br />c:\Program Files\Norton AntiVirus\navapsvc.exe<br />C:\WINDOWS\System32\nvsvc32.exe<br />C:\Program Files\Softex\OmniPass\Omniserv.exe<br />C:\WINDOWS\System32\MsPMSPSv.exe<br />C:\Program Files\Softex\OmniPass\OPXPApp.exe<br />C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe<br />C:\WINDOWS\Explorer.EXE<br />C:\WINDOWS\System32\ctfmon.exe<br />C:\windows\system\hpsysdrv.exe<br />C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe<br />C:\Program Files\HP\HP Software Update\HPWuSchd.exe<br />C:\WINDOWS\System32\hphmon05.exe<br />C:\HP\KBD\KBD.EXE<br />C:\Program Files\Common Files\Real\Update_OB\realsched.exe<br />C:\Program Files\Common Files\Symantec Shared\ccApp.exe<br />C:\Program Files\Multimedia Card Reader\shwicon2k.exe<br />C:\WINDOWS\ALCXMNTR.EXE<br />C:\Program Files\DIGStream\digstream.exe<br />C:\Program Files\Winamp\winampa.exe<br />C:\Program Files\QuickTime\qttask.exe<br />C:\Program Files\iTunes\iTunesHelper.exe<br />C:\WINDOWS\xsobb.exe<br />C:\Program Files\AIM\aim.exe<br />C:\WINDOWS\System32\rundll32.exe<br />c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe<br />C:\Program Files\Valve\Steam\Steam.exe<br />C:\Program Files\iPod\bin\iPodService.exe<br />C:\Program Files\FinePixViewer\QuickDCF.exe<br />C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe<br />C:\Program Files\LimeWire\LimeWire 4.2.5\LimeWire.exe<br />C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe<br />C:\WINDOWS\System32\wuauclt.exe<br />C:\Program Files\ISTsvc\istsvc.exe<br />C:\Program Files\Mozilla Firefox\firefox.exe<br />C:\Program Files\Winamp\winamp.exe<br />C:\DOCUME~1\OWNER~1.LAD\LOCALS~1\Temp\Rar$EX00.703\HijackThis.exe<br /><br />R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/<br />R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/<br />R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50141<br />R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/<br />R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/<br />R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/<br />R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141<br />R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141<br />R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = <br />R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost<br />R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = <br />R3 - Default URLSearchHook is missing<br />O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx<br />O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll<br />O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)<br />O2 - BHO: (no name) - {A35B7996-C654-BFDC-2934-EDECAEE01ACF} - C:\WINDOWS\System32\qnh.dll<br />O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll<br />O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll<br />O2 - BHO: (no name) - {E434D3C7-A673-4100-8140-79C020945017} - (no file)<br />O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx<br />O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll<br />O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll<br />O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll<br />O3 - Toolbar: (no name) - {53829F91-1B06-4DB9-B13E-812A986169F9} - (no file)<br />O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll<br />O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe<br />O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe<br />O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe<br />O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd.exe"<br />O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe<br />O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe<br />O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE<br />O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r<br />O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot<br />O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE<br />O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE<br />O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup<br />O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect<br />O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"<br />O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"<br />O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe<br />O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE<br />O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe<br />O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe<br />O4 - HKLM\..\Run: [tlepyp] C:\WINDOWS\System32\tpjhcc.exe<br />O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe<br />O4 - HKLM\..\Run: [JVM0.12] C:\WINDOWS\System32\fktnyq.exe<br />O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime<br />O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe<br />O4 - HKLM\..\Run: [JVM0.14] C:\WINDOWS\System32\hhqzwuo.exe<br />O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe<br />O4 - HKLM\..\Run: [¢‰¸u0–4C<br /><br />}ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\xsobb.exe<br />O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe<br />O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe<br />O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook<br />O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe<br />O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized<br />O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background<br />O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet<br />O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl<br />O4 - HKCU\..\Run: [Mfujav] C:\WINDOWS\System32\?ttrib.exe<br />O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent<br />O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe<br />O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe<br />O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe<br />O4 - Global Startup: Exif Launcher.lnk = ?<br />O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe<br />O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe<br />O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe<br />O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present<br />O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present<br />O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML<br />O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000<br />O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll<br />O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll<br />O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL<br />O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe<br />O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)<br />O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)<br />O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll<br />O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE<br />O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE<br />O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll<br />O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe<br />O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab<br />O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll<br />O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll<br />O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll<br />O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe<br />O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe<br />O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE<br />O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe<br />O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe<br />O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe<br />O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe<br /><!-- end code provided by createblog.com -->