Need some help please...

Advertise at AfterDawn.com

Link to us!

Private messages

Compose a private message

List of all updated threads

Threads without replies

Search messages

Saturday 30.8.2025 / 14:54

Search AfterDawn Forums:

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > need some help please...

Browse by topic

Forums

Start a new thread

Need some help please...

Jump to:

Posted

Message

rdrake

Newbie

10. February 2007 @ 12:36

Link to this message

My computer has slowed down significantly within the past few weeks and it freezes ALL of the time. Any help would be greatly appreciated. Here is my HijackThis report...

Logfile of HijackThis v1.99.1
Scan saved at 4:34:24 PM, on 2/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\AOL\1141110056\ee\AOLSoftware.exe
C:\WINDOWS\svcwinra.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\resfilter32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe
C:\Program Files\Nero\Nero 7\Nero Vision\NeroVision.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Documents and Settings\Reid\Desktop\Yeah\Unused Desktop Shortcuts\HijackThis_v1.99.1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.insightbb.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\lsucmqhk.dll (file missing)
O2 - BHO: (no name) - {F5F61936-783C-4A61-80C3-76BB0654F1A9} - C:\WINDOWS\repair\ualasmvc.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SAClient] "C:\Program Files\Insight\BBClient\Programs\RegCon.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1141110056\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [WhatsNewBot] NSYSCPLSTR.exe
O4 - HKLM\..\Run: [typeconf] avpmondll.exe
O4 - HKLM\..\Run: [cf172] C:\Program Files\Cf1728c00-zzuks\csrss.exe
O4 - HKLM\..\Run: [plginit] C:\WINDOWS\svcwinra.exe
O4 - HKLM\..\Run: [dmkki.exe] C:\WINDOWS\system32\dmkki.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [clamav] xxtoolbar.exe
O4 - HKCU\..\Run: [Preliminary] prcmon.exe
O4 - HKCU\..\Run: [SysSupport] Trayz.exe
O4 - HKCU\..\Run: [cf172] C:\Program Files\Cf1728c00-zzuks\csrss.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O20 - Winlogon Notify: ualasmvc - C:\WINDOWS\repair\ualasmvc.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

[ + quote]

Waymon3X6

Senior Member

10. February 2007 @ 16:09

Link to this message

Hello rdrake, I have looked at your log and Have found some malware that is in your computer. Lets start with the serious things. Please put a check next to the following:

O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\lsucmqhk.dll (file missing)

O2 - BHO: (no name) - {F5F61936-783C-4A61-80C3-76BB0654F1A9} - C:\WINDOWS\repair\ualasmvc.dll (file missing)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [dmkki.exe] C:\WINDOWS\system32\dmkki.exe

O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"

O20 - Winlogon Notify: ualasmvc - C:\WINDOWS\repair\ualasmvc.dll (file missing)

-----------------------

Now, I have found some other things that I am unfamilar with, but I am leaning toward thinking that they are some kind of malware. Here they are:

C:\WINDOWS\svcwinra.exe

C:\WINDOWS\resfilter32.exe

O4 - HKLM\..\Run: [WhatsNewBot] NSYSCPLSTR.exe

O4 - HKLM\..\Run: [typeconf] avpmondll.exe

O4 - HKLM\..\Run: [cf172] C:\Program Files\Cf1728c00-zzuks\csrss.exe

O4 - HKLM\..\Run: [plginit] C:\WINDOWS\svcwinra.exe

O4 - HKCU\..\Run: [clamav] xxtoolbar.exe

O4 - HKCU\..\Run: [Preliminary] prcmon.exe

O4 - HKCU\..\Run: [SysSupport] Trayz.exe

O4 - HKCU\..\Run: [cf172] C:\Program Files\Cf1728c00-zzuks\csrss.exe

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab - Check if you know this site and fix it if you do not.Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed.

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) - This looks like a hacking tool, a tool that catches "packets" from your computer, or a different computer, and uses them to display what the victim is searching, or looking at on the internt.

Ok, that should do it, post back if you have anymore questions or problems!

[ + quote]

Come Visit Maxishines Website and Check Out His Forum!

3DMark06 Score - 20k Club | Youtube Account

Start a new thread

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > need some help please...


		User name	Password

		Not registered yet? Register here. Lost your password? Click here.