Code:Logfile of HijackThis v1.99.1 Scan saved at 1:06:21 PM, on 3/14/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\rundll32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\AlteerUser.ALTEER.000\Local Settings\Temp\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://216.130.185.122/sidesearch.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Provided by Advanced Medical Technologies R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F3 - REG:win.ini: run= O1 - Hosts: 66.180.173.39 www.google.ae O1 - Hosts: 66.180.173.39 www.google.am O1 - Hosts: 66.180.173.39 www.google.as O1 - Hosts: 66.180.173.39 www.google.at O1 - Hosts: 66.180.173.39 www.google.az O1 - Hosts: 66.180.173.39 www.google.be O1 - Hosts: 66.180.173.39 www.google.bi O1 - Hosts: 66.180.173.39 www.google.ca O1 - Hosts: 66.180.173.39 www.google.cd O1 - Hosts: 66.180.173.39 www.google.cg O1 - Hosts: 66.180.173.39 www.google.ch O1 - Hosts: 66.180.173.39 www.google.ci O1 - Hosts: 66.180.173.39 www.google.cl O1 - Hosts: 66.180.173.39 www.google.co.cr O1 - Hosts: 66.180.173.39 www.google.co.hu O1 - Hosts: 66.180.173.39 www.google.co.il O1 - Hosts: 66.180.173.39 www.google.co.in O1 - Hosts: 66.180.173.39 www.google.co.je O1 - Hosts: 66.180.173.39 www.google.co.jp O1 - Hosts: 66.180.173.39 www.google.co.ke O1 - Hosts: 66.180.173.39 www.google.co.kr O1 - Hosts: 66.180.173.39 www.google.co.ls O1 - Hosts: 66.180.173.39 www.google.co.nz O1 - Hosts: 66.180.173.39 www.google.co.th O1 - Hosts: 66.180.173.39 www.google.co.ug O1 - Hosts: 66.180.173.39 www.google.co.uk O1 - Hosts: 66.180.173.39 www.google.co.ve O1 - Hosts: 66.180.173.39 www.google.com O1 - Hosts: 66.180.173.39 www.google.com.ag O1 - Hosts: 66.180.173.39 www.google.com.ar O1 - Hosts: 66.180.173.39 www.google.com.au O1 - Hosts: 66.180.173.39 www.google.com.br O1 - Hosts: 66.180.173.39 www.google.com.co O1 - Hosts: 66.180.173.39 www.google.com.cu O1 - Hosts: 66.180.173.39 www.google.com.do O1 - Hosts: 66.180.173.39 www.google.com.ec O1 - Hosts: 66.180.173.39 www.google.com.fj O1 - Hosts: 66.180.173.39 www.google.com.gi O1 - Hosts: 66.180.173.39 www.google.com.gr O1 - Hosts: 66.180.173.39 www.google.com.gt O1 - Hosts: 66.180.173.39 www.google.com.hk O1 - Hosts: 66.180.173.39 www.google.com.ly O1 - Hosts: 66.180.173.39 www.google.com.mt O1 - Hosts: 66.180.173.39 www.google.com.mx O1 - Hosts: 66.180.173.39 www.google.com.my O1 - Hosts: 66.180.173.39 www.google.com.na O1 - Hosts: 66.180.173.39 www.google.com.nf O1 - Hosts: 66.180.173.39 www.google.com.ni O1 - Hosts: 66.180.173.39 www.google.com.np O1 - Hosts: 66.180.173.39 www.google.com.pa O1 - Hosts: 66.180.173.39 www.google.com.pe O1 - Hosts: 66.180.173.39 www.google.com.ph O1 - Hosts: 66.180.173.39 www.google.com.pk O1 - Hosts: 66.180.173.39 www.google.com.pr O1 - Hosts: 66.180.173.39 www.google.com.py O1 - Hosts: 66.180.173.39 www.google.com.sa O1 - Hosts: 66.180.173.39 www.google.com.sg O1 - Hosts: 66.180.173.39 www.google.com.sv O1 - Hosts: 66.180.173.39 www.google.com.tr O1 - Hosts: 66.180.173.39 www.google.com.tw O1 - Hosts: 66.180.173.39 www.google.com.ua O1 - Hosts: 66.180.173.39 www.google.com.uy O1 - Hosts: 66.180.173.39 www.google.com.vc O1 - Hosts: 66.180.173.39 www.google.com.vn O1 - Hosts: 66.180.173.39 www.google.de O1 - Hosts: 66.180.173.39 www.google.dj O1 - Hosts: 66.180.173.39 www.google.dk O1 - Hosts: 66.180.173.39 www.google.es O1 - Hosts: 66.180.173.39 www.google.fi O1 - Hosts: 66.180.173.39 www.google.fm O1 - Hosts: 66.180.173.39 www.google.fr O1 - Hosts: 66.180.173.39 www.google.gg O1 - Hosts: 66.180.173.39 www.google.gl O1 - Hosts: 66.180.173.39 www.google.gm O1 - Hosts: 66.180.173.39 www.google.hn O1 - Hosts: 66.180.173.39 www.google.ie O1 - Hosts: 66.180.173.39 www.google.it O1 - Hosts: 66.180.173.39 www.google.kz O1 - Hosts: 66.180.173.39 www.google.li O1 - Hosts: 66.180.173.39 www.google.lt O1 - Hosts: 66.180.173.39 www.google.lu O1 - Hosts: 66.180.173.39 www.google.lv O1 - Hosts: 66.180.173.39 www.google.mn O1 - Hosts: 66.180.173.39 www.google.ms O1 - Hosts: 66.180.173.39 www.google.mu O1 - Hosts: 66.180.173.39 www.google.mw O1 - Hosts: 66.180.173.39 www.google.nl O1 - Hosts: 66.180.173.39 www.google.no O1 - Hosts: 66.180.173.39 www.google.off.ai O1 - Hosts: 66.180.173.39 www.google.pl O1 - Hosts: 66.180.173.39 www.google.pn O1 - Hosts: 66.180.173.39 www.google.pt O1 - Hosts: 66.180.173.39 www.google.ro O1 - Hosts: 66.180.173.39 www.google.ru O1 - Hosts: 66.180.173.39 www.google.rw O1 - Hosts: 66.180.173.39 www.google.se O1 - Hosts: 66.180.173.39 www.google.sh O1 - Hosts: 66.180.173.39 www.google.sk O1 - Hosts: 66.180.173.39 www.google.sm O1 - Hosts: 66.180.173.39 www.google.td O1 - Hosts: 66.180.173.39 www.google.tm O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINNT\isrvs\sysupd.dll O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file) O3 - Toolbar: Begin2Search.com Bar - {207AEF46-0596-4966-A7BF-098F247E85BB} - C:\WINNT\system32\ic2_win.dll O3 - Toolbar: (no name) - {12EE7A5E-0674-42f9-A76B-000000004D00} - (no file) O3 - Toolbar: Search Bar - {4E7BD74F-2B8D-469E-A1F6-FC7EB590A97D} - C:\WINNT\DOWNLO~1\search3.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [Opware12] "C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe" O4 - HKLM\..\Run: [urqdvrfzrs] C:\WINNT\system32\poxqfkh.exe O4 - HKLM\..\Run: [conscorr] C:\WINNT\conscorr.exe O4 - HKLM\..\Run: [MoodLogic Updater] C:\Program Files\MoodLogic\Service\Updater.exe O4 - HKLM\..\Run: [satmat] C:\WINNT\satmat.exe O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitetcz32.exe O4 - HKLM\..\Run: [winupdtl] C:\WINNT\system32\winupdt.exe O4 - HKLM\..\Run: [npkdbc] C:\WINNT\system32\npkdbc.exe O4 - HKLM\..\Run: [woshnahj] C:\Program Files\woshnahj\woshnahj.exe O4 - HKLM\..\Run: [C:\WINNT\npnwmnq.exe] C:\WINNT\npnwmnq.exe O4 - HKLM\..\Run: [xyzfmc] C:\WINNT\system32\xyzfmc.exe O4 - HKLM\..\Run: [App32dll] C:\winnt\system32\msnavc32.exe lee0105 O4 - HKLM\..\Run: [Bvowtmn] C:\Program Files\Rkka\Hpxt.exe O4 - HKLM\..\Run: [Gpdwphac] C:\Program Files\Tcdhmd\Yeinnkp.exe O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1 O4 - HKLM\..\Run: [scrsvc] C:\WINNT\system32\scrsvc.exe O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [SiS Tray] C:\WINNT\system32\sistray.EXE O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\system32\khooker.exe O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wvgrki.exe O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\ALTEER~1.000\LOCALS~1\Temp\BundleLite_razormedia1003.exe run O4 - HKLM\..\Run: [We4M502m] C:\winnt\system32\We4M502m.exe O4 - HKLM\..\Run: [gZxZJ.exe] c:\winnt\system32\gZxZJ.exe O4 - HKLM\..\Run: [BPT] "C:\Program Files\Bpt\bpt.exe" O4 - HKLM\..\Run: [DI2] "C:\DOCUME~1\ALTEER~1.000\LOCALS~1\Temp\27.exe\27.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [vga256] C:\WINNT\system32\vga256.exe O4 - HKCU\..\Run: [wshtcpip] C:\WINNT\system32\wshtcpip.exe O4 - HKCU\..\Run: [sysmonnt] C:\WINNT\system32\sysmonnt O4 - HKCU\..\Run: [ezwbr] C:\WINNT\system32\ezwbr.exe O4 - Startup: OpenOffice.org 1.1.3.lnk = C:\Program Files\OpenOffice.org1.1.3\program\quickstart.exe O4 - Global Startup: hkitnu.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: ScanDirect.lnk = C:\Program Files\Visioneer\PaperPort\ppscandr.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: Your PC is infected with Spyware - click here to fix your PC - {FB74C951-ACA1-4e33-A94C-A9261EB2CCB7} - https://www.spydeleter.com/order2.php?KBID=1062 (file missing) O15 - Trusted Zone: http://ad.searchsquire.com O15 - Trusted Zone: http://search.searchsquire.com O15 - Trusted Zone: http://update.searchsquire.com O15 - Trusted Zone: http://www.searchsquire.com O15 - Trusted Zone: http://*.searchsquire.com O16 - DPF: {07637823-C894-4A52-B3F9-5D777FD8E36A} - http://www.mydailyhoroscope.net/mdh/install.cab O16 - DPF: {197AB1D7-A7DD-4C86-A938-1FCC0DB21B85} (DMProxyCtl Class) - http://dm.cometsystems.com/dm/dm_286.cab O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {8E66A776-A350-4D69-8783-906DB0E6DF14} (Jaunt Class) - http://download.jaunt.com/public/jaunt.cab O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0010.exe O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} - http://ads.dealhelper.com/updates/DealHelperNew.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = alteer.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = alteer.local O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = alteer.local O18 - Protocol: relatedlinks - {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE} - (no file) O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINNT\isrvs\mfiltis.dll O20 - Winlogon Notify: CSCSettings - C:\WINNT\system32\jtlu0739e.dll O20 - Winlogon Notify: PCANotify - C:\WINNT\SYSTEM32\PCANotify.dll O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\WINNT\System32\MsiExec.exe (file missing) O23 - Service: OmniForm Printer - Unknown owner - C:\WINNT\System32\ofps.exe (file missing)
I have ran spybot and stinger and gotten rid of alot of stuff but need help with this. I attempted to upload info to the site but it gave me an error.
Any help would be appreciated.
Thanks in advance
Jeremy
. 