Can't get rid of Adlogix Broweser Hijacker - Hijack This Log

  1. #1
    oscara is offline Newbie

    Can't get rid of Adlogix Broweser Hijacker - Hijack This Log

    For the life of me, I can't get rid of this Adlogix Hijacker. I run Spyware Doctor which finds the Adlogix file. Spyware Doctor says that it has removed the file but every time I do a new scan the Adlogix file is still there. I have ran all through a host of other programs to try and eliminate this issue with now success. Here's my Hijack this Log and hopefully someone will have some advice on how to cure this illnes.

    Thanks in advance.

    Oscar

    Logfile of HijackThis v1.99.1
    Scan saved at 2:29:59 PM, on 3/21/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\xl.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\jopqvkeo.exe
    C:\WINDOWS\system\kjhbsjpau.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\System32\axoadk\ghxrpvbh.exe
    C:\Program Files\ScanSpyware v3.8.0.4\Scanner.exe
    C:\PROGRA~1\SPYWAR~1\swdoctor.exe
    C:\WINDOWS\System32\taskmgr.exe
    C:\WINDOWS\System32\sdsd\wktu.exe
    C:\WINDOWS\System32\rtekk\edunsuuh.exe
    C:\WINDOWS\System32\rbkxhcu\egbjy.exe
    C:\WINDOWS\System32\jluygv\sgoaqmx.exe
    C:\WINDOWS\System32\kvrglec\ovbr.exe
    C:\PROGRA~1\EZULA\mmod.exe
    C:\WINDOWS\System32\wuauclt.exe
    c:\Program Files\Bpt\bpt.exe
    c:\Program Files\bpc_search\BPCv2.exe
    C:\WINDOWS\System32\loctvrfy.exe
    C:\WINDOWS\System32\makcap32.exe
    C:\Program Files\AutoUpdate\AutoUpdate.exe
    C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
    C:\WINDOWS\System32\vmss\vmss.exe
    C:\Documents and Settings\Visitor\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {075F1C04-41A4-D472-7A32-6E9E482B9B7E} - C:\WINDOWS\System32\fwaibhjk\erhspwxa.dll
    O2 - BHO: FlashEnhancer Extender - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - c:\Program Files\Flen\flen.dll
    O2 - BHO: (no name) - {3BF51CB0-2FE2-449D-92F1-A4BA0D195AD7} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: MSW.cIExplorer - {4B57B77A-B130-4EB8-8CFB-42B880F6D311} - C:\Documents and Settings\All Users\Application Data\msw\MSW.dll
    O2 - BHO: (no name) - {5127222B-60DB-4106-A297-6BFEAC81F054} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {55B64C05-8D9A-DA6B-C46C-AF7833CB9F90} - C:\WINDOWS\System32\btro.dll
    O2 - BHO: CAUN Object - {59F12660-2B92-4554-98F9-87295AD8A0CE} - C:\WINDOWS\System32\AUNBHO.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: SDWin32 Class - {7B7E0A4B-423C-450A-887B-B6CDF1865229} - C:\WINDOWS\System32\sdxsj.dll
    O2 - BHO: (no name) - {84029C0E-9816-F044-913D-529DD4A54AC5} - C:\WINDOWS\System32\cvqekdmi\eexhmfof.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: (no name) - {BCF50D3B-E249-43A7-AAA5-0C7215F8C618} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {C6D7D755-4507-400F-9053-42CC812CE9E6} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {CD1723BE-32F8-4694-95F6-F9CD7E43DB78} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {DE61CE22-554C-41AD-B439-5E9E1BD2BA42} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {E8003BE3-6D6C-4C4E-8F18-F4C0326584C9} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [Uninstall0001] "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.stripsaver.com!StatsStripSaver
    O4 - HKLM\..\Run: [o73V3tW] makcap32.exe
    O4 - HKLM\..\Run: [b39bnpnd] C:\Program Files\b39bnpnd\b39bnpnd.exe
    O4 - HKLM\..\Run: [mjpilwhu] C:\WINDOWS\System32\xefbeamr\mjpilwhu.exe
    O4 - HKLM\..\Run: [cjksjuwm] C:\WINDOWS\System32\cecdh\cjksjuwm.exe
    O4 - HKLM\..\Run: [btjoknhb] C:\WINDOWS\System32\sdne\btjoknhb.exe
    O4 - HKLM\..\Run: [lwsuqxja] C:\WINDOWS\System32\ecvwjgj\lwsuqxja.exe
    O4 - HKLM\..\Run: [hgkpnu] C:\WINDOWS\System32\bhjfw\hgkpnu.exe
    O4 - HKLM\..\Run: [hovdotlp] C:\WINDOWS\System32\hudo\hovdotlp.exe
    O4 - HKLM\..\Run: [Enh Win Updt] C:\WINDOWS\enhupdt.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [C:\WINDOWS\jopqvkeo.exe] C:\WINDOWS\jopqvkeo.exe
    O4 - HKLM\..\Run: [egbjy] C:\WINDOWS\System32\rbkxhcu\egbjy.exe
    O4 - HKLM\..\Run: [ovbr] C:\WINDOWS\System32\kvrglec\ovbr.exe
    O4 - HKLM\..\Run: [ghxrpvbh] C:\WINDOWS\System32\axoadk\ghxrpvbh.exe
    O4 - HKLM\..\Run: [sgoaqmx] C:\WINDOWS\System32\jluygv\sgoaqmx.exe
    O4 - HKLM\..\Run: [wktu] C:\WINDOWS\System32\sdsd\wktu.exe
    O4 - HKLM\..\Run: [edunsuuh] C:\WINDOWS\System32\rtekk\edunsuuh.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\bhlhvni.exe
    O4 - HKLM\..\Run: [BPT] "c:\Program Files\Bpt\bpt.exe"
    O4 - HKLM\..\Run: [Breg] "c:\Program Files\Common Files\Java\bptre.exe"
    O4 - HKLM\..\Run: [FlenCPY] "c:\Program Files\Common Files\Java\flencpy.exe"
    O4 - HKLM\..\Run: [BPCv2] c:\Program Files\bpc_search\BPCv2.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [skyhn] C:\DOCUME~1\Visitor\LOCALS~1\Temp\jitbye.exe
    O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
    O4 - HKLM\..\Run: [vmss] C:\WINDOWS\System32\vmss\vmss.exe
    O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
    O4 - HKLM\..\RunOnce: [bcpc_c] "c:\Program Files\Bpt\bpt_c.exe"
    O4 - HKLM\..\RunOnce: [flc] "c:\Program Files\Common Files\Java\flenclean.exe"
    O4 - HKLM\..\RunOnce: [f] "c:\Program Files\Flen\flenclean.exe"
    O4 - HKLM\..\RunOnce: [BPCv2_re] c:\Program Files\Common Files\Java\bpc2_re_inst.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Zws9Rja3Q] loctvrfy.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
    O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O4 - Global Startup: Event Reminder.lnk = ?
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com...ll/xscan60.cab
    O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_4us.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: egbjyrbkxhcu - Unknown owner - C:\WINDOWS\System32\rbkxhcu\egbjy.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe
    O23 - Service: XtreamLok License Manager - Unknown owner - C:\WINDOWS\System32\xl.exe


  2. #2
    owen is offline D-A-L Team Member (UK)
    Save 20% on AVG Internet Security 2012 Suite!
    Entries in blue are ones that I can't find any reference to. If you don't know what they are, fix them and delete the corresponding files further on in the instructions.

    Close all browser windows, restart Hijack This and put a checkmark next to the following entries:

    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {075F1C04-41A4-D472-7A32-6E9E482B9B7E} - C:\WINDOWS\System32\fwaibhjk\erhspwxa.dll
    O2 - BHO: (no name) - {3BF51CB0-2FE2-449D-92F1-A4BA0D195AD7} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: MSW.cIExplorer - {4B57B77A-B130-4EB8-8CFB-42B880F6D311} - C:\Documents and Settings\All Users\Application Data\msw\MSW.dll
    O2 - BHO: (no name) - {5127222B-60DB-4106-A297-6BFEAC81F054} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {55B64C05-8D9A-DA6B-C46C-AF7833CB9F90} - C:\WINDOWS\System32\btro.dll
    O2 - BHO: CAUN Object - {59F12660-2B92-4554-98F9-87295AD8A0CE} - C:\WINDOWS\System32\AUNBHO.dll
    O2 - BHO: SDWin32 Class - {7B7E0A4B-423C-450A-887B-B6CDF1865229} - C:\WINDOWS\System32\sdxsj.dll
    O2 - BHO: (no name) - {84029C0E-9816-F044-913D-529DD4A54AC5} - C:\WINDOWS\System32\cvqekdmi\eexhmfof.dll
    O2 - BHO: (no name) - {BCF50D3B-E249-43A7-AAA5-0C7215F8C618} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {C6D7D755-4507-400F-9053-42CC812CE9E6} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {CD1723BE-32F8-4694-95F6-F9CD7E43DB78} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {DE61CE22-554C-41AD-B439-5E9E1BD2BA42} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: (no name) - {E8003BE3-6D6C-4C4E-8F18-F4C0326584C9} - C:\Program Files\b39bnpnd\b39bnpnd.dll
    O2 - BHO: FlashEnhancer Extender - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - c:\Program Files\Flen\flen.dll
    O4 - HKLM\..\Run: [Uninstall0001] "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.stripsaver.com!StatsStripSaver
    O4 - HKLM\..\Run: [o73V3tW] makcap32.exe
    O4 - HKLM\..\Run: [b39bnpnd] C:\Program Files\b39bnpnd\b39bnpnd.exe
    O4 - HKLM\..\Run: [mjpilwhu] C:\WINDOWS\System32\xefbeamr\mjpilwhu.exe
    O4 - HKLM\..\Run: [cjksjuwm] C:\WINDOWS\System32\cecdh\cjksjuwm.exe
    O4 - HKLM\..\Run: [btjoknhb] C:\WINDOWS\System32\sdne\btjoknhb.exe
    O4 - HKLM\..\Run: [lwsuqxja] C:\WINDOWS\System32\ecvwjgj\lwsuqxja.exe
    O4 - HKLM\..\Run: [hgkpnu] C:\WINDOWS\System32\bhjfw\hgkpnu.exe
    O4 - HKLM\..\Run: [hovdotlp] C:\WINDOWS\System32\hudo\hovdotlp.exe
    O4 - HKLM\..\Run: [Enh Win Updt] C:\WINDOWS\enhupdt.exe
    O4 - HKLM\..\Run: [C:\WINDOWS\jopqvkeo.exe] C:\WINDOWS\jopqvkeo.exe
    O4 - HKLM\..\Run: [egbjy] C:\WINDOWS\System32\rbkxhcu\egbjy.exe
    O4 - HKLM\..\Run: [ovbr] C:\WINDOWS\System32\kvrglec\ovbr.exe
    O4 - HKLM\..\Run: [ghxrpvbh] C:\WINDOWS\System32\axoadk\ghxrpvbh.exe
    O4 - HKLM\..\Run: [sgoaqmx] C:\WINDOWS\System32\jluygv\sgoaqmx.exe
    O4 - HKLM\..\Run: [wktu] C:\WINDOWS\System32\sdsd\wktu.exe
    O4 - HKLM\..\Run: [edunsuuh] C:\WINDOWS\System32\rtekk\edunsuuh.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\bhlhvni.exe
    O4 - HKLM\..\Run: [BPT] "c:\Program Files\Bpt\bpt.exe"
    O4 - HKLM\..\Run: [Breg] "c:\Program Files\Common Files\Java\bptre.exe"
    O4 - HKLM\..\Run: [FlenCPY] "c:\Program Files\Common Files\Java\flencpy.exe"
    O4 - HKLM\..\Run: [BPCv2] c:\Program Files\bpc_search\BPCv2.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [skyhn] C:\DOCUME~1\Visitor\LOCALS~1\Temp\jitbye.exe
    O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
    O4 - HKLM\..\Run: [vmss] C:\WINDOWS\System32\vmss\vmss.exe
    O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
    O4 - HKLM\..\RunOnce: [bcpc_c] "c:\Program Files\Bpt\bpt_c.exe"
    O4 - HKLM\..\RunOnce: [flc] "c:\Program Files\Common Files\Java\flenclean.exe"
    O4 - HKLM\..\RunOnce: [f] "c:\Program Files\Flen\flenclean.exe"
    O4 - HKLM\..\RunOnce: [BPCv2_re] c:\Program Files\Common Files\Java\bpc2_re_inst.exe
    O4 - HKCU\..\Run: [Zws9Rja3Q] loctvrfy.exe
    O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
    O23 - Service: egbjyrbkxhcu - Unknown owner - C:\WINDOWS\System32\rbkxhcu\egbjy.exe

    Click Fix Checked

    Then boot into Safe Mode and ensure that you are showing Hidden Files and Folders.

    Go to C:\documents and settings\Visitor\local settings\temp and once in the folder click Edit> Select All. Then hit the delete key to get rid of the entire contents of the folder. Leave the folder itself intact though.


    Delete the following files and folders:
    C:\WINDOWS\System32\fwaibhjk
    C:\Program Files\b39bnpnd
    C:\Documents and Settings\All Users\Application Data\msw
    C:\WINDOWS\System32\cvqekdmi
    c:\Program Files\Flen
    C:\Program Files\Common Files\Totem Shared
    C:\WINDOWS\System32\makcap32.exe
    C:\WINDOWS\System32\xefbeamr
    C:\WINDOWS\System32\cecdh
    C:\WINDOWS\System32\sdne
    C:\WINDOWS\System32\ecvwjgj
    C:\WINDOWS\System32\bhjfw
    C:\WINDOWS\System32\hudo
    C:\WINDOWS\enhupdt.exe
    C:\WINDOWS\jopqvkeo.exe
    C:\WINDOWS\System32\rbkxhcu
    C:\WINDOWS\System32\kvrglec
    C:\WINDOWS\System32\axoadk
    C:\WINDOWS\System32\jluygv
    C:\WINDOWS\System32\sdsd
    C:\WINDOWS\System32\rtekk
    C:\WINDOWS\System32\bhlhvni.exe
    c:\Program Files\Common Files\Java\bptre.exe
    c:\Program Files\Common Files\Java\flencpy.exe
    c:\Program Files\bpc_search
    C:\Program Files\AutoUpdate
    C:\WINDOWS\System32\wsxsvc
    C:\WINDOWS\System32\vmss
    C:\WINDOWS\farmmext.exe
    c:\Program Files\Bpt
    c:\Program Files\Common Files\Java\flenclean.exe
    c:\Program Files\Common Files\Java\bpc2_re_inst.exe
    C:\WINDOWS\System32\loctvrfy.exe
    C:\PROGRA~1\ezula
    C:\WINDOWS\System32\rbkxhcu

    Reboot and post a fresh log

+ Reply to Thread