MyLog

[Bones40]

Logfile of HijackThis v1.99.1
Scan saved at 8:27:42 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Dad\Desktop\Temp\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SXG Advisor - {32A3489E-5C5A-42CA-8DBB-0EE46C55F013} - C:\WINDOWS\dpvtporsot.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: SXG Advisor - {878CA87E-BD03-4991-A1A8-A1EBEB50578F} - C:\WINDOWS\dgtxrdfsnw.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: The elfwgps - {3728161D-8A68-4F3F-A8E1-96A4F9C93DB8} - C:\WINDOWS\elfwgps.dll
O3 - Toolbar: ekvgsnw - {292547EC-9C38-4398-B336-6219B91A1634} - C:\WINDOWS\ekvgsnw.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197861967967
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197865732045
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: bqxomdo - {AA58CD8A-19E1-483E-81F6-EAF5F2873B53} - C:\WINDOWS\bqxomdo.dll (file missing)
O21 - SSODL: aswmklt - {2FEBD090-8D60-4B84-857D-E7E383A3633C} - C:\WINDOWS\aswmklt.dll (file missing)
O21 - SSODL: alofkmn - {572D2429-250A-4118-97E1-0B475E9C69CF} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: bxlrvps - {B2BFE0BD-4BC4-4F49-BA71-5A18AB7CD9E8} - C:\WINDOWS\bxlrvps.dll (file missing)
O21 - SSODL: RamRunOnce - {db36dd32-d603-47ab-9793-ae0c392c0d5e} - C:\WINDOWS\Installer\{db36dd32-d603-47ab-9793-ae0c392c0d5e}\RamRunOnce.dll
O21 - SSODL: RunOnceVolume - {92abdfcf-8cb0-44bc-b6ed-362a2269c075} - C:\WINDOWS\Installer\{92abdfcf-8cb0-44bc-b6ed-362a2269c075}\RunOnceVolume.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

[Guest]

Hello, visitor!

The Hijack This log analyzer has analyzed your log. Please take a closer look on the results.

Your log does not indicate any spyware or virus infection. However, there are some entries that you might want to fix. Please follow the steps below.

The following entries are not malicious, but some of them are not used anymore. You may use HijackThis to fix a few of them. However, please keep in mind that some of the entries marked as Questionable or Not Needed are fully legitimate and might be required by installed software to work properly, while some others might be related to certain parasites. It is up to you to decide whether you need any of them, or not.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - Startup: PowerReg Scheduler.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra ''Tools'' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra ''Tools'' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197861967967
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197865732045
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O21 - SSODL: bqxomdo - {AA58CD8A-19E1-483E-81F6-EAF5F2873B53} - C:\WINDOWS\bqxomdo.dll (file missing)
O21 - SSODL: aswmklt - {2FEBD090-8D60-4B84-857D-E7E383A3633C} - C:\WINDOWS\aswmklt.dll (file missing)
O21 - SSODL: bxlrvps - {B2BFE0BD-4BC4-4F49-BA71-5A18AB7CD9E8} - C:\WINDOWS\bxlrvps.dll (file missing)
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)


The following files and Windows registry entries are marked as "unknown". Currently, the HijackThis Log Analyzer cannot provide required information on these items. The files and entries in the list below can be both malicious and fully legitimate. Because of this, please do not take any action! Wait for the forum responders or other forum users to provide you with necessary details and further instructions.
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SXG Advisor - {32A3489E-5C5A-42CA-8DBB-0EE46C55F013} - C:\WINDOWS\dpvtporsot.dll
O2 - BHO: SXG Advisor - {878CA87E-BD03-4991-A1A8-A1EBEB50578F} - C:\WINDOWS\dgtxrdfsnw.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: The elfwgps - {3728161D-8A68-4F3F-A8E1-96A4F9C93DB8} - C:\WINDOWS\elfwgps.dll
O3 - Toolbar: ekvgsnw - {292547EC-9C38-4398-B336-6219B91A1634} - C:\WINDOWS\ekvgsnw.dll
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O21 - SSODL: alofkmn - {572D2429-250A-4118-97E1-0B475E9C69CF} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: RamRunOnce - {db36dd32-d603-47ab-9793-ae0c392c0d5e} - C:\WINDOWS\Installer\{db36dd32-d603-47ab-9793-ae0c392c0d5e}\RamRunOnce.dll
O21 - SSODL: RunOnceVolume - {92abdfcf-8cb0-44bc-b6ed-362a2269c075} - C:\WINDOWS\Installer\{92abdfcf-8cb0-44bc-b6ed-362a2269c075}\RunOnceVolume.dll
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

If you want to see more detailed analysis of your log, click here.

Thank you for using the 2-Spyware.com HijackThis log analyzer beta 2!

[Bones40]

I'd appreciate it if someone would take a look at my log a little closer.  The analyzer says there's nothing wrong, but I am gettiing a weird pop up every now and then referring me to a anti-spyware deal.  I get a message presumabley from Windows Internet Explorer.

The message say, "Notice: Your system is not optimized and your computer performance is not at the highest level.  Full system optimization will greatly increase your computer's performance and prevent data loss.  Would you like to install SystemErrorFixer to optimiz your computer's performance now for free? (Recommended)"

There's also another message.  And sometimes a IE popup will go to a site, I forget exactly which site, but will edit this message when it happens again.

Thanks.

[Bobby]

hello again
according to our databe SystemErrorFixer is one month old parasite. as it's not very fresh, security tools should pick it up. SystemErrorFixer  is a malware, so i'm not sure if antivirus should detect it or not. does avast locate SystemErrorFixer as parasite? if not, i suggest you try anti spyware. and there's also manual SystemErrorFixer removal here.

[Bones40]

Thanks for the response Bobby.

I'm doing numerous scans with Avast and Spysweeper every day.  Avast finds stuff, but I've never noticed if it's specifically SystemErrorFixer or not, and even after putting it in the virus chest, the pop ups continue.

Same deal with Spysweeper.  It finds spyware nearly every time I scan, and I do the recommended actions when it finds them, but again it the pop ups still occur.  I know at least once SpySweeper found SystemErrorFixer.

I'll try the manual removal link.  I haven't looked at the one you posted yet, but I did try one site that gave directions and it required me to use the Task Manager, which I think has been attacked as well.  Whenever I try to bring it up, it says that it has been disabled by the administrator.  That will be the next problem I attack, or the first if it's required to remove SystemErrorFixor.

I'll post back after I've tried your link.  Thanks again for the help.

*edit* I just tried the manual removal instructions in the link you provided.  I got the task manager to work, but couldn't find the processes the instructions said to remove.  I didn't find any of the entries in the registry it told me to delete (by the way, is it just me or are a few of those entries repeated numerous times in those instructions?)  

In short, I don't know what to do right now.  Any more help would be appreciated.  Maybe I got rid of SystemErrorFixer and it's something else that's plaguing me?

[Bobby]

SystemErrorFixer maybe 'updated' after its description was added on this website. we will update the description and let you know so you could try again. there's also a possibility that what you got is not SystemErrorFixer, but some other new/updated malware. if it wasn't new or updated security tools could detect and remove it.could you make another hijackthis log and post it on new topic under this forum section?

[Bones40]

It seems it is TrustedAntivirus now.  I think I got rid of SystemErrorFixer.