Hi voltron1000!!
According to your log your computer is infected with severals pestwares.
As a first step I suggest you (as hummer-ga did) to use some specific
programs for this tasks:
Remember to disable System Restore if your operating system is Windows Me or XP.
1- Scan your computer for virus or trojans, preferably an online scan
(because the installed antivirus could be hijacked too!!). Try with
the following free services:
"Trend Micro - Free online virus Scan":
http://housecall.trendmicro.com/
GFI - Free online Trojan scanner", an online tool dedicated to detect
trojans in your computer:
http://www.trojanscan.com/
Note: if you want to use your installed antivirus software, connect to
Internet and update the virus definitions.
-----------------------------------------------------------
2- Scan your computer to detect spyware, adware or other type of
badware. To do this you can perform an online scan or run an
antispyware software:
Online spyware scanner:
"PestPAtrol's free online spyware scanner":
http://www.pestscan.com/ScanOrTrial.asp
Anti Spyware software:
"Ad-aware" from Lavasoft: (freeware)
http://lavasoft.element5.com/software/adaware/
"SpyBot Search and Destroy": (freeware)
http://www.safer-networking.org/index.php?page=spybotsd
---------------------------------------------------------
3- When the two first steps are accomplished please reboot your
computer and run HijackThis and check o fix if still present the
following items:
Note: You can skip the first two steps, but it is not a suggested way
to remove the pests.
Running Processes:
C:\WINDOWS\System32\zsxcwiac.exe
C:\WINDOWS\System32\systime.exe
C:\windows\vcpdll.exe
C:\windows\winln.exe
C:\Documents and Settings\Owner\Application Data\wtta.exe
C:\WINDOWS\System32\?hkdsk.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://srch-us5.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://213.159.117.134/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://213.159.117.134/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://srch-us5.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant
= about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
= about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
http://default-homepage-network.com/start.cgi?hkcu
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
http://213.159.117.134/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Yahoo! Companion BHO -
{02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program
Files\ycomp5_1_6_0.dll (file missing)
O2 - BHO: (no name) - {0DEF33F0-B28F-4CF8-A010-5C957596BA4A} -
C:\WINDOWS\System32\hfglf.dll
O2 - BHO: adlog Class - {22B9A67D-E689-44B6-B775-0E8FE84B4F9B} -
C:\WINDOWS\System32\htikegm.dll
O2 - BHO: sr - {5742F79A-1D91-42c4-990C-B46CF55A6478} - C:\WINDOWS\setfgi.dll
O2 - BHO: (no name) - {9BC9F807-65E9-1967-ED5B-4B761D635096} -
C:\WINDOWS\System32\khwo.dll
O2 - BHO: Curl - {A78CC2FF-6E4E-4556-B27C-D7C3A70D7A50} -
C:\WINDOWS\System32\NDrv.dll (file missing)
O2 - BHO: (no name) - {} - (no file)
O4 - HKLM\..\Run: [udhinwakh] C:\WINDOWS\System32\zsxcwiac.exe
O4 - HKLM\..\Run: [hjdemwp] C:\WINDOWS\System32\pxoraru.exe
O4 - HKLM\..\Run: [palsmqh] C:\WINDOWS\System32\umkgxhf.exe
O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\System32\systime.exe
O4 - HKCU\..\Run: [dnpyumu] C:\WINDOWS\System32\givzk.exe k:dnpyumu:
O4 - HKCU\..\Run: [plxpjsuj] C:\WINDOWS\System32\vqjr.exe k:plxpjsuj:
O4 - HKCU\..\Run: [cmsound] c:\windows\vcpdll.exe
O4 - HKCU\..\Run: [winltmpv] c:\windows\winln.exe
O4 - HKCU\..\Run: [SysTime] C:\WINDOWS\System32\systime.exe
O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
O4 - HKCU\..\Run: [Der] C:\WINDOWS\System32\?hkdsk.exe
O8 - Extra context menu item: >>> EasyWWW.com -Your Easy Surf Home! -
http://www.easywww.com/
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: http://*.frame.crazywinnings.com
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.xxxtoolbar.com
O16 - DPF: {11111111-1111-1111-1111-111111111157} -
ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} -
http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) -
http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
http://oldglory.ninesystems.com/AxisCamControl.ocx
IMPORTANT NOTE:
When you fix these types of entries with HijackThis, HijackThis will
attempt to the delete the offending file listed. There are times that
the file may be in use even if Internet Explorer is shut down. If the
file still exists after you fix it with HijackThis, it is recommended
that you reboot into safe mode and delete the offending file.
After fix all these items, if still present in your computer, delete the files:
C:\WINDOWS\System32\zsxcwiac.exe
C:\WINDOWS\System32\systime.exe
C:\windows\vcpdll.exe
C:\windows\winln.exe
C:\Documents and Settings\Owner\Application Data\wtta.exe
C:\WINDOWS\System32\?hkdsk.exe
C:\WINDOWS\System32\pxoraru.exe
C:\WINDOWS\System32\umkgxhf.exe
C:\WINDOWS\System32\givzk.exe
C:\WINDOWS\System32\vqjr.exe
C:\WINDOWS\System32\hfglf.dll
C:\WINDOWS\System32\htikegm.dll
C:\WINDOWS\setfgi.dll
C:\WINDOWS\System32\khwo.dll
----------------------------------------------------------
The following pages gives you some background and additional (and
useful) info related to the pests that must be removed from your
computer:
"Tech Support Forum - ?HKDSK.EXE Help!?":
http://www.techsupportforum.com/archive/index.php/t-18604.html
"Remove Conducent TimeSink, removal instructions" (vcpdll.dll):
http://www.2-spyware.com/remove-conducent-timesink.html
"Sophos virus analysis: Troj/Dloader-VN" (winln.exe & setfgi.dll):
See Description tab.
http://www.sophos.com/virusinfo/analyses/trojdloadervn.html
"Remove http://213.159.117.134/index.php hijacker":
http://www.bleepingcomputer.com/forums/index.php?s=70950d76c44d0b74b12e3fc7d3d5e33c&showtopic=3373&st=0&#entry23207
"Can anyone tell me what this file does zsxcwiac.exe and how do I get
rid of it???":
http://forums.devshed.com/t194264/s.html
----------------------------------------------------------
"HijackThis Tutorial":
Please take a look at this page.
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42
-----------------------------------------------------------
I hope that this helps you. Please use the clarification feature
before rate this answer if you need further assistance. I will gladly
respond all your requests for a clarification until you feel satisfied
with the answer.
Best regards.
livioflores-ga |
