[Jimbobthepirate]

I installed xp again yesterday after numerous problems and when i restarted and after a few updates i ran spyware doctor and smitfraud was there. Hijack this and killbox and spybot and smitfraud could not get rid of it. So formated and re-installed again. Hijack this log, please could someone check over and make sure it's clean.

Logfile of HijackThis v1.99.1
Scan saved at 06:10:14, on 27/12/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTFMON.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\mysvcc.exe
C:\WINDOWS\System32\FrameWork.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\J\Desktop\New Folder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [mysvcig38] mysvcc.exe
O4 - HKLM\..\Run: [FrameWork 2.5] FrameWork.exe
O4 - HKLM\..\RunServices: [mysvcig38] mysvcc.exe
O4 - HKLM\..\RunServices: [FrameWork 2.5] FrameWork.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{C532CE07-BAA8-473A-85A0-C438108E193D}: NameServer = 212.139.132.22 212.139.132.23

 

[Frank4d]

You have a worm. One of the malware experts should be able to help you with it:
C:\WINDOWS\System32\FrameWork.exe
O4 - HKLM\..\Run: [mysvcig38] mysvcc.exe
O4 - HKLM\..\RunServices: [mysvcig38] mysvcc.exe

I don't see any anti-virus running. Did you install one before plugging in to the internet?

 

[Jimbobthepirate]

Thank you and i just downloaded avg anti spyware and avg anti virus and about to run trend micro online scan. I removed those files and am about to restart heres a newer hijackthis log after avg found 5.

Logfile of HijackThis v1.99.1
Scan saved at 06:42:54, on 27/12/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\wpabaln.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgwb.dat
C:\Documents and Settings\J\Desktop\New Folder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {3FD6B99C-A275-46ea-8FD1-3D63986E51E4} - C:\WINDOWS\System32\vnwtsnvy.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AAA31BDA-7A55-4254-8C6A-FA41CA6F9F7B} - C:\WINDOWS\System32\ddaba.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{76520A8A-9D68-44F2-8C17-30FA4F5FE8FF}: NameServer = 212.139.132.20 212.139.132.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{76520A8A-9D68-44F2-8C17-30FA4F5FE8FF}: NameServer = 212.139.132.20 212.139.132.21
O20 - Winlogon Notify: ddaba - C:\WINDOWS\System32\ddaba.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Windows Terminal Manager - Unknown owner - C:\WINDOWS\system32\vcmon.exe (file missing)

Any ideas? I thought a format was suposed to remove all this =(

 

[~Candy~]

Well, the fact that your name speaks highly and the fact that you have NO SERVICE packs installed, just may mean, that your name is telling the real story here

 

[ozrom1e]

I really think what is trying to be asked here is, Is this a legal version of Windows?

 

[~Candy~]

Um, yeah, that too

 

[cybertech]

Is this the same machine?
http://forums.techguy.org/security/529885-serious-trojan-virus.html

 

[~Candy~]

My bet is on YES

 

[TRS-80 vet]

Well, the fact that your name speaks highly and the fact that you have NO SERVICE packs installed, just may mean, that your name is telling the real story here

I'm a pirate! ECU Pirates alum.

Due process? Bah. Humbug!

 

[TRS-80 vet]

I really think what is trying to be asked here is, Is this a legal version of Windows?

I say summary execution. What say ye, oz?