HELP - Something's hijacked the pc (ultimate cleaner 2007?)

jussme7

ok thank you here is my SDFix report:

SDFix: Version 1.99
Run by Administrator on Tue 08/21/2007 at 03:55 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\Krista\MYDOCU~1\SDFix
Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...

Normal Mode:
Checking Files:
No Trojan Files Found


Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.


Final Check:
Remaining Services:

---

Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Restaurant Empire\\re.exe"="C:\\Program Files\\Restaurant Empire\\re.exe:*:Enabled:re"
"C:\\Program Files\\iWin Games\\iWinGames.exe"="C:\\Program Files\\iWin Games\\iWinGames.exe:*:Enabled:iWin Games application."
"C:\\Program Files\\iWin Games\\WebUpdater.exe"="C:\\Program Files\\iWin Games\\WebUpdater.exe:*:Enabled:iWin Games updater."
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
Remaining Files:

---

Registry Backups: - C:\DOCUME~1\Krista\MYDOCU~1\SDFix\backups\backupreg.zip
Full Registry Backup: - C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
Files with Hidden Attributes:
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT1.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT10.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT11.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT12.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT13.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT14.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT15.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT2.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT3.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT4.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT5.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT6.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT7.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT8.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT9.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITA.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITB.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITC.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITD.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITE.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITF.tmp
C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll
C:\Program Files\Canon\MP Navigator 2.0\Maint.exe
C:\Program Files\Mysteryville 2\gamefiles\Mysteryville2.exe
C:\WINDOWS\WSYS049.SYS
C:\WINDOWS\system32\KGyGaAvL.sys
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT1.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT10.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT11.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT12.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT13.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT14.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT15.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT2.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT3.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT4.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT5.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT6.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT7.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT8.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BIT9.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITA.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITB.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITC.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITD.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITE.tmp
C:\Documents and Settings\Krista\Local Settings\Application Data\Google\Google Desktop Search\Slideshow\renreynolds.blogspot.com~feeds~posts~default\BITF.tmp
Finished

and here is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:08:29 PM, on 8/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRAM FILES\FAXTALK COMMUNICATOR\FTCtrl32.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRAM FILES\FAXTALK COMMUNICATOR\FAPIEXE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - !!06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - !!761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: IEHlprObj Class - !!8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
O2 - BHO: Windows Live Sign-in Helper - !!9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint - !!327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - !!2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\PROGRAM FILES\FAXTALK COMMUNICATOR\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ErrorRepairPro] C:\Program Files\Error Repair Professional\autostart.exe
O4 - HKCU\..\Run: [SecurePCCleaner] C:\Program Files\SecurePCCleaner\GDC.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - !!08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - !!08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: !!0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: !!4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by114fd.bay114.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: !!5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5088/mcfscan.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
--
End of file - 8160 bytes

is everything ok now??

pchelpman

Just one entry to fix ...


Open HJT ... click on 'Do a System Scan Only'... put a tick/check mark next to this entry IF still present ...

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

Remember to close ALL open browser windows – including this one – before clicking on “Fix Checked” at the foot of the HijackThis window.

************

Is everything working as it should on your computer now? If not let us know what's not right.

I have some closing remarks to make if all is now well with your machine.


PCH

jussme7

it's still quite a bit slower than it used to be....I've been told a registry cleanup would fix that, is that true?

Luffy321

Hello, if anyo ne is there can you please help me. I have the same problem as mookybagirl and i have downloaded hijackthis and combofix but i need an expert to look at my logs. I know it sounds pathetic but could you please help me and go through it step by step.

Alfonso_Skinarelli

Luffy321 wrote: »

Hello, if anyo ne is there can you please help me. I have the same problem as mookybagirl and i have downloaded hijackthis and combofix but i need an expert to look at my logs. I know it sounds pathetic but could you please help me and go through it step by step.

Please start a new topic with the requested log files.

Luffy321

How do i start a new topic?

Browntoa

go here

http://forums.moneysavingexpert.com/forumdisplay.html?f=29

click on the Blue "new Thread" button