Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HJT log- please help


  • Please log in to reply
11 replies to this topic

#1 eden517

eden517

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 03 February 2005 - 09:59 AM

Logfile of HijackThis v1.99.0
Scan saved at 8:48:28 AM, on 2/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Lotus\Sametime Client\Connect.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\taskmngr.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\LivePerson\hc.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\JPotash\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abosearch.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abosearch.com/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abosearch.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abosearch.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abosearch.com/index.html
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.50.160.142 localhost
O1 - Hosts: 69.50.160.142 downloads.aaa1screensavers.com #[Bargin Buddy]
O1 - Hosts: 69.50.160.142 dl.aaascreensavers.com
O1 - Hosts: 69.50.160.142 abcsearch.com
O1 - Hosts: 69.50.160.142 admin.abcsearch.com
O1 - Hosts: 69.50.160.142 www3.abcsearch.com #[Browseraid]
O1 - Hosts: 69.50.160.142 www.abcsearch.com
O1 - Hosts: 69.50.160.142 abc517.net #[Trojan.Mitglieder.H]
O1 - Hosts: 69.50.160.142 absoluagency.com #[Trojan.StartPage.H]
O1 - Hosts: 69.50.160.142 acestats.com
O1 - Hosts: 69.50.160.142 www.acestats.com
O1 - Hosts: 69.50.160.142 actualnames.com #[Parasite.ActualNames][Spyware.ActualNames]
O1 - Hosts: 69.50.160.142 www.actualnames.com
O1 - Hosts: 69.50.160.142 ad-up.com
O1 - Hosts: 69.50.160.142 www.ad-up.com
O1 - Hosts: 69.50.160.142 adatom.com
O1 - Hosts: 69.50.160.142 aesp.adatom.com
O1 - Hosts: 69.50.160.142 adbest.com
O1 - Hosts: 69.50.160.142 adserv.adbonus.com
O1 - Hosts: 69.50.160.142 www.adbonus.com
O1 - Hosts: 69.50.160.142 ad2.adcept.net
O1 - Hosts: 69.50.160.142 ad3.adcept.net
O1 - Hosts: 69.50.160.142 www.adcept.net
O1 - Hosts: 69.50.160.142 adcomplete.com
O1 - Hosts: 69.50.160.142 www.adcomplete.com
O1 - Hosts: 69.50.160.142 www.adcopy.info
O1 - Hosts: 69.50.160.142 ads.adcorps.com
O1 - Hosts: 69.50.160.142 ads.addynamix.com
O1 - Hosts: 69.50.160.142 pt.server1.adexit.com
O1 - Hosts: 69.50.160.142 www.adexit.com
O1 - Hosts: 69.50.160.142 www.ad4ever.com
O1 - Hosts: 69.50.160.142 adhearus.com
O1 - Hosts: 69.50.160.142 display2.adhearus.com
O1 - Hosts: 69.50.160.142 ssl3.adhost.com
O1 - Hosts: 69.50.160.142 www2.adhost.com
O1 - Hosts: 69.50.160.142 www.addme.com
O1 - Hosts: 69.50.160.142 www.adinfinity.com
O1 - Hosts: 69.50.160.142 te.adlandpro.com
O1 - Hosts: 69.50.160.142 classic.adlink.de
O1 - Hosts: 69.50.160.142 regio.adlink.de
O1 - Hosts: 69.50.160.142 west.adlink.de
O1 - Hosts: 69.50.160.142 www.adminder.com
O1 - Hosts: 69.50.160.142 adsfac.net
O1 - Hosts: 69.50.160.142 www.adonweb.com
O1 - Hosts: 69.50.160.142 www.adrelevance.com #[NetRatings]
O1 - Hosts: 69.50.160.142 media.adrevolver.com
O1 - Hosts: 69.50.160.142 adroar.com
O1 - Hosts: 69.50.160.142 ads.adroar.com
O1 - Hosts: 69.50.160.142 delta.adroar.com
O1 - Hosts: 69.50.160.142 iads.adroar.com #[Adware.AdRoar][ADW_ADROAR.A]
O1 - Hosts: 69.50.160.142 lists.adroar.com
O1 - Hosts: 69.50.160.142 www.adroar.com
O1 - Hosts: 69.50.160.142 ads.adsag.com
O1 - Hosts: 69.50.160.142 di.adsag.com
O1 - Hosts: 69.50.160.142 img.adsag.com
O1 - Hosts: 69.50.160.142 adserv.com
O1 - Hosts: 69.50.160.142 www.adserv.com
O1 - Hosts: 69.50.160.142 ads.adtomi.com
O1 - Hosts: 69.50.160.142 www.adtomi.com #[Adware.Adtomi]
O1 - Hosts: 69.50.160.142 downldcl.adtoolsinc.com
O1 - Hosts: 69.50.160.142 www.adtoolsinc.com
O1 - Hosts: 69.50.160.142 www.adtrader.com
O1 - Hosts: 69.50.160.142 survey.advantageresearch.com
O1 - Hosts: 69.50.160.142 ad.adver.com.tw
O1 - Hosts: 69.50.160.142 ads.advertise.net
O1 - Hosts: 69.50.160.142 advertisingvision.com #[Adware.Advision]
O1 - Hosts: 69.50.160.142 www.advertisingvision.com
O1 - Hosts: 69.50.160.142 adviva.com
O1 - Hosts: 69.50.160.142 www.adviva.com
O1 - Hosts: 69.50.160.142 ads.adviva.net
O1 - Hosts: 69.50.160.142 adstats.adviva.net
O1 - Hosts: 69.50.160.142 tracker.affistats.com #[msvrl.dll]
O1 - Hosts: 69.50.160.142 www.affiliatefuel.com
O1 - Hosts: 69.50.160.142 banners.affiliatefuel.com
O1 - Hosts: 69.50.160.142 affiliatetarget.com
O1 - Hosts: 69.50.160.142 www.affiliatetarget.com
O1 - Hosts: 69.50.160.142 fcds.affiliatetracking.net
O1 - Hosts: 69.50.160.142 our.affiliatetracking.net
O1 - Hosts: 69.50.160.142 www.affiliatetracking.net
O1 - Hosts: 69.50.160.142 www.affiliatetracking.com
O1 - Hosts: 69.50.160.142 partner.ah-ha.com #[Troj/Subsear-A][Adware-SSF.dr]
O1 - Hosts: 69.50.160.142 adserver.aim4media.com
O1 - Hosts: 69.50.160.142 adtest.aim4media.com
O1 - Hosts: 69.50.160.142 pops.aim4media.com
O1 - Hosts: 69.50.160.142 www.aim4media.com
O1 - Hosts: 69.50.160.142 crs.akamai.com
O1 - Hosts: 69.50.160.142 soap.alexa.com #[Spyware.Alexa][Alexa Toolbar]
O1 - Hosts: 69.50.160.142 www.alexa.com
O1 - Hosts: 69.50.160.142 allcheapsolutions.com #[Backdoor-CIE]
O1 - Hosts: 69.50.160.142 ads.as4x.tmcs.akadns.net #[Ticketmaster]
O1 - Hosts: 69.50.160.142 bantam.ai.net
O1 - Hosts: 69.50.160.142 fiona.ai.net
O1 - Hosts: 69.50.160.142 ads.amazingmedia.com
O1 - Hosts: 69.50.160.142 bohema.amillo.net #[Trojan.Mitglieder.H]
O1 - Hosts: 69.50.160.142 adserver04.ancestry.com #[RealMedia]
O1 - Hosts: 69.50.160.142 ads.antionline.com
O1 - Hosts: 69.50.160.142 junior.apk.net
O1 - Hosts: 69.50.160.142 banner.arttoday.com
O1 - Hosts: 69.50.160.142 associmg.com #[amazon.com]
O1 - Hosts: 69.50.160.142 armbender.com #[UCSearch.ucUCSearch][W32.Adclicker.F.Trojan]
O1 - Hosts: 69.50.160.142 www.armbender.com #[UCSearch.ArmBender]
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {F2A4407B-FFBC-4A1F-A18A-0F68C3E0FC9E} - C:\WINDOWS\System32\jowiya.dll
O2 - BHO: (no name) - {F3411675-AD82-9A3B-D5E6-2A8CFB9DB089} - C:\WINDOWS\System32\xaqebeq.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Sametime Connect] C:\Program Files\Lotus\Sametime Client\Connect.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [taskmngr] C:\WINDOWS\System32\taskmngr.exe
O4 - Startup: exploit[1].exe
O4 - Startup: Inventory Scan.LNK = C:\LDClient\LDISCN32.EXE
O4 - Startup: Timpani.lnk = C:\Program Files\LivePerson\hc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: Sametime Meeting Room Client ST25PF1 - http://vcr.welchallyn.org/sametime/stmeeti...gRoomClient.cab
O16 - DPF: Sametime Meeting Room Client ST31 - http://meeting.eden.com/sametime/stmeeting...gRoomClient.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1097010793060
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://meeting.webex.com/client/v_meeting/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EDENAD.com
O17 - HKLM\Software\..\Telephony: DomainName = EDENAD.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{27E1FADB-B084-4EF9-A9E2-AE0C834265BB}: Domain = nycap.rr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EDENAD.com
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: LANDesk® Management Agent - Unknown - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Lotus Domino Server (LotusDominoData) - Unknown - C:\Lotus\Domino\nservice.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

BC AdBot (Login to Remove)

 


#2 SirJon

SirJon

    Malware Prevention


  • Malware Response Team
  • 230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:15 AM

Posted 03 February 2005 - 10:52 AM

Hello eden517 and Welcome! :thumbsup:

NOTE: You might want to print out these instructions beforehand.

First, you need to move HijackThis.exe out of this directory:
C:\Documents and Settings\JPotash\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

Save Hijackthis.exe in a permanent folder named hijackthis on the root of your C:\drive. Double-click on My Computer; double-click on your hard drive, (usually the C:\drive) right-click on a blank area, choose New, choose Folder, name the folder hijackthis. Now, place Hijackthis.exe in this folder.

Second, before using HijackThis, let's try to remove as much as we can with a few malware utilities.

Step 1:
Please go to Start, Settings, Control Panel, Add/Remove Programs, and uninstall any unknown or suspicious looking programs and/or toolbars. After the uninstall process is complete, reboot the PC and see if your symptoms have disappeared. If the same symptoms still exist following the reboot, proceed to Step 2.

Step 2:
Download and install the latest version of Ad-Aware SE here

NOTE: If you are still using Ad-Aware 6, go to Add/Remove Programs in the Control Panel and uninstall it now before installing Ad-Aware SE.
Please configure the program by following these instructions here. Before scanning click on "Check for updates now" to make sure you have the latest reference file.

Please do not run a scan with Ad-Aware yet.

Step 3:
Download CWShredder™ Version 2.1 here and save it to its own folder named CWShredder. Save it at the root of the C:\drive the same location as HijackThis.

Please do not run a scan with CWShredder yet.

Step 4:
Download and install the Microsoft AntiSpyware program here.
Please configure the program by following these instructions here. Before scanning click on "File" then click "Check for Updates" to make sure you have the latest reference files.

Please do not run a scan with the Microsoft AntiSpyware program yet.

Step 5:
Download and install the latest version of Spybot here.
Please configure the program by following these instructions here. Before scanning click on "Search for Updates" then click "Download Updates" to make sure you have the latest reference files.

Please do not run a scan with Spybot yet.

Step 6:
Download and install CCleaner here.

Please do not run the CCleaner utility yet.

Step 7:
Download the eScan Antivirus Toolkit here. Save it to the desktop. Before running the program, we need to update the signature files first.

Step 8:
Updating the eScan Antivirus Toolkit with the latest files:
1.) Double-click on the mwav.exe file saved to the desktop; it will extract the program files to new folder called Kaspersky at the root of the C:\drive in Windows, C:\Kaspersky.
2.) Double-click on My Computer, double-click on the Hard Drive (usually the C:\drive), find and double-click on the Kaspersky folder; inside the Kaspersky folder, find and double-click on the kavupd.exe file.
3.) Double-clicking on the kavupd.exe file open the command prompt (DOS screen) and update the program with all the latest signature files. By default, the update process creates a folder on the root of the C:\drive called Downloads. This is where the updated files are placed.
4.) After the update is complete, copy and paste these new updated signature files (from the C:\Downloads folder) to the C:\Kaspersky folder where eScan originally extracted the antivirus program files.

Please do not run a scan with the eScan Antivirus Toolkit utility yet.

Step 9:
If you think you have the about:blank hijacker or you experience long delays trying to go to websites or you are redirected to various search pages or get constant popup ads, please download CWShredder™ Version 2.1 here. Save it to its own folder named CWShredder and place it at the root of your C:\drive along with HijackThis. There is a variant of the Coolwebsearch trojan that closes several anti-spyware programs when you try to open them. If this is happening to you, download the CoolWWWSearch.SmartKiller removal tool here first and run it. After it completes its scan, CWShredder and HijackThis should run properly.

Please do not run a scan with the CWShredder utility yet.

Step 10:
Please enable all hidden files and folders in Windows. For instructions click here

Step 11:
Please reboot into Safe Mode. For instructions click here

Step 12:
From Safe Mode, run the eScan Antivirus Toolkit. Please follow these instructions:
1.) To run the eScan Antivirus Toolkit program, look for a file called mwavscan.com inside the C:\Kaspersky folder.
2.) Double-click on the mwavscan.com file; this will open the eScan program.
3.) With the eScan interface on your desktop, make sure that the boxes under Scan Option, Memory, Registry, Startup Folders, System Folders, Services, are checked.
4.) Check the Drive box, this will create a another Drive box below it, check this second Drive box as well, now a large window across from the second Drive box appears. In this window use the drop-down arrow and choose the drive letter of your hard drive, usually C:\.
5.) Below these boxes, make sure the box Scan All Files is checked, not Program Files.
6.) Click the Scan Clean (or Scan) button and let the utility run until it completes a thorough scan of your hard drive. When the scan has finished it will read Scan Completed.

Step 13:
From Safe Mode, run the CWShredder program you downloaded earlier. Double-click on CWShredder.exe to open it, click the 'Fix->' button (not 'Scan Only') and you'll be prompted that CWShredder will shutdown any Internet Explorer and Windows Media Player windows, click OK to continue and let it run completely to delete anything it finds. After its scan, click Next, then Exit.

Step 14:
From Safe Mode, run the Microsoft AntiSpyware program you downloaded and configured earlier, click "Spyware Scan", "Spyware Options" click "Full System Scan" place checks in all boxes, let it scan the hard drive and delete all entries it finds.

Step 15:
From Safe Mode, run the Ad-Aware SE program you downloaded and configured earlier, make sure "Perform full system scan" is checked, let it scan the hard drive and delete all entries it finds. Run the program again a second time.

Step 16:
From Safe Mode, run the Spybot program you downloaded and configured earlier, click "Check for problems", let it scan the hard drive and delete all entries it finds.

Step 17:
From Safe Mode, open CCleaner, click on Options, Settings, uncheck the box "Only delete files in Windows Temp folders older than 48 hours", click OK. Using the default settings, click Run Cleaner and let it scan for all files and folders. (You'll see the results in the large Progress window.) Click Exit and reboot the PC. Now all the temp files and folders are clean, even your index.dat files are gone.

Step 18:
When you have completed scanning with all the malware removal utilities above, please reboot the PC back into Normal mode. (Windows)

Step 19:
Now reboot back into Normal Mode (Windows) and open HijackThis, click on "Do a system scan and save and save a logfile", copy and paste the entire contents of the logfile here for review.

Edited by SirJon, 03 February 2005 - 03:37 PM.


#3 eden517

eden517
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 07 February 2005 - 08:58 AM

I followed the instructions you have given me. Thank you. I ran into a few problems while going throught the directions. First, I was unable to update the latest files for the escan antivirus toolkit. It would try for about two minutes and finally get process failed. Also, CWShredder would crash a few seconds after it started. And oddly, I couldn't update the Ad-Aware with the latest definitions. I have always been able to. But I continued through despite these issues to see what happens. I rebooted and ran HiJackThis and the following is what I got. (I noticed that my home page had changed again, and that my host file was also changed again.) Thank you again for the help.

Logfile of HijackThis v1.99.0
Scan saved at 8:48:28 AM, on 2/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Lotus\Sametime Client\Connect.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\taskmngr.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\LivePerson\hc.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\JPotash\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abosearch.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abosearch.com/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abosearch.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abosearch.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abosearch.com/index.html
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.50.160.142 localhost
O1 - Hosts: 69.50.160.142 downloads.aaa1screensavers.com #[Bargin Buddy]
O1 - Hosts: 69.50.160.142 dl.aaascreensavers.com
O1 - Hosts: 69.50.160.142 abcsearch.com
O1 - Hosts: 69.50.160.142 admin.abcsearch.com
O1 - Hosts: 69.50.160.142 www3.abcsearch.com #[Browseraid]
O1 - Hosts: 69.50.160.142 www.abcsearch.com
O1 - Hosts: 69.50.160.142 abc517.net #[Trojan.Mitglieder.H]
O1 - Hosts: 69.50.160.142 absoluagency.com #[Trojan.StartPage.H]
O1 - Hosts: 69.50.160.142 acestats.com
O1 - Hosts: 69.50.160.142 www.acestats.com
O1 - Hosts: 69.50.160.142 actualnames.com #[Parasite.ActualNames][Spyware.ActualNames]
O1 - Hosts: 69.50.160.142 www.actualnames.com
O1 - Hosts: 69.50.160.142 ad-up.com
O1 - Hosts: 69.50.160.142 www.ad-up.com
O1 - Hosts: 69.50.160.142 adatom.com
O1 - Hosts: 69.50.160.142 aesp.adatom.com
O1 - Hosts: 69.50.160.142 adbest.com
O1 - Hosts: 69.50.160.142 adserv.adbonus.com
O1 - Hosts: 69.50.160.142 www.adbonus.com
O1 - Hosts: 69.50.160.142 ad2.adcept.net
O1 - Hosts: 69.50.160.142 ad3.adcept.net
O1 - Hosts: 69.50.160.142 www.adcept.net
O1 - Hosts: 69.50.160.142 adcomplete.com
O1 - Hosts: 69.50.160.142 www.adcomplete.com
O1 - Hosts: 69.50.160.142 www.adcopy.info
O1 - Hosts: 69.50.160.142 ads.adcorps.com
O1 - Hosts: 69.50.160.142 ads.addynamix.com
O1 - Hosts: 69.50.160.142 pt.server1.adexit.com
O1 - Hosts: 69.50.160.142 www.adexit.com
O1 - Hosts: 69.50.160.142 www.ad4ever.com
O1 - Hosts: 69.50.160.142 adhearus.com
O1 - Hosts: 69.50.160.142 display2.adhearus.com
O1 - Hosts: 69.50.160.142 ssl3.adhost.com
O1 - Hosts: 69.50.160.142 www2.adhost.com
O1 - Hosts: 69.50.160.142 www.addme.com
O1 - Hosts: 69.50.160.142 www.adinfinity.com
O1 - Hosts: 69.50.160.142 te.adlandpro.com
O1 - Hosts: 69.50.160.142 classic.adlink.de
O1 - Hosts: 69.50.160.142 regio.adlink.de
O1 - Hosts: 69.50.160.142 west.adlink.de
O1 - Hosts: 69.50.160.142 www.adminder.com
O1 - Hosts: 69.50.160.142 adsfac.net
O1 - Hosts: 69.50.160.142 www.adonweb.com
O1 - Hosts: 69.50.160.142 www.adrelevance.com #[NetRatings]
O1 - Hosts: 69.50.160.142 media.adrevolver.com
O1 - Hosts: 69.50.160.142 adroar.com
O1 - Hosts: 69.50.160.142 ads.adroar.com
O1 - Hosts: 69.50.160.142 delta.adroar.com
O1 - Hosts: 69.50.160.142 iads.adroar.com #[Adware.AdRoar][ADW_ADROAR.A]
O1 - Hosts: 69.50.160.142 lists.adroar.com
O1 - Hosts: 69.50.160.142 www.adroar.com
O1 - Hosts: 69.50.160.142 ads.adsag.com
O1 - Hosts: 69.50.160.142 di.adsag.com
O1 - Hosts: 69.50.160.142 img.adsag.com
O1 - Hosts: 69.50.160.142 adserv.com
O1 - Hosts: 69.50.160.142 www.adserv.com
O1 - Hosts: 69.50.160.142 ads.adtomi.com
O1 - Hosts: 69.50.160.142 www.adtomi.com #[Adware.Adtomi]
O1 - Hosts: 69.50.160.142 downldcl.adtoolsinc.com
O1 - Hosts: 69.50.160.142 www.adtoolsinc.com
O1 - Hosts: 69.50.160.142 www.adtrader.com
O1 - Hosts: 69.50.160.142 survey.advantageresearch.com
O1 - Hosts: 69.50.160.142 ad.adver.com.tw
O1 - Hosts: 69.50.160.142 ads.advertise.net
O1 - Hosts: 69.50.160.142 advertisingvision.com #[Adware.Advision]
O1 - Hosts: 69.50.160.142 www.advertisingvision.com
O1 - Hosts: 69.50.160.142 adviva.com
O1 - Hosts: 69.50.160.142 www.adviva.com
O1 - Hosts: 69.50.160.142 ads.adviva.net
O1 - Hosts: 69.50.160.142 adstats.adviva.net
O1 - Hosts: 69.50.160.142 tracker.affistats.com #[msvrl.dll]
O1 - Hosts: 69.50.160.142 www.affiliatefuel.com
O1 - Hosts: 69.50.160.142 banners.affiliatefuel.com
O1 - Hosts: 69.50.160.142 affiliatetarget.com
O1 - Hosts: 69.50.160.142 www.affiliatetarget.com
O1 - Hosts: 69.50.160.142 fcds.affiliatetracking.net
O1 - Hosts: 69.50.160.142 our.affiliatetracking.net
O1 - Hosts: 69.50.160.142 www.affiliatetracking.net
O1 - Hosts: 69.50.160.142 www.affiliatetracking.com
O1 - Hosts: 69.50.160.142 partner.ah-ha.com #[Troj/Subsear-A][Adware-SSF.dr]
O1 - Hosts: 69.50.160.142 adserver.aim4media.com
O1 - Hosts: 69.50.160.142 adtest.aim4media.com
O1 - Hosts: 69.50.160.142 pops.aim4media.com
O1 - Hosts: 69.50.160.142 www.aim4media.com
O1 - Hosts: 69.50.160.142 crs.akamai.com
O1 - Hosts: 69.50.160.142 soap.alexa.com #[Spyware.Alexa][Alexa Toolbar]
O1 - Hosts: 69.50.160.142 www.alexa.com
O1 - Hosts: 69.50.160.142 allcheapsolutions.com #[Backdoor-CIE]
O1 - Hosts: 69.50.160.142 ads.as4x.tmcs.akadns.net #[Ticketmaster]
O1 - Hosts: 69.50.160.142 bantam.ai.net
O1 - Hosts: 69.50.160.142 fiona.ai.net
O1 - Hosts: 69.50.160.142 ads.amazingmedia.com
O1 - Hosts: 69.50.160.142 bohema.amillo.net #[Trojan.Mitglieder.H]
O1 - Hosts: 69.50.160.142 adserver04.ancestry.com #[RealMedia]
O1 - Hosts: 69.50.160.142 ads.antionline.com
O1 - Hosts: 69.50.160.142 junior.apk.net
O1 - Hosts: 69.50.160.142 banner.arttoday.com
O1 - Hosts: 69.50.160.142 associmg.com #[amazon.com]
O1 - Hosts: 69.50.160.142 armbender.com #[UCSearch.ucUCSearch][W32.Adclicker.F.Trojan]
O1 - Hosts: 69.50.160.142 www.armbender.com #[UCSearch.ArmBender]
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {F2A4407B-FFBC-4A1F-A18A-0F68C3E0FC9E} - C:\WINDOWS\System32\jowiya.dll
O2 - BHO: (no name) - {F3411675-AD82-9A3B-D5E6-2A8CFB9DB089} - C:\WINDOWS\System32\xaqebeq.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Sametime Connect] C:\Program Files\Lotus\Sametime Client\Connect.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [taskmngr] C:\WINDOWS\System32\taskmngr.exe
O4 - Startup: exploit[1].exe
O4 - Startup: Inventory Scan.LNK = C:\LDClient\LDISCN32.EXE
O4 - Startup: Timpani.lnk = C:\Program Files\LivePerson\hc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: Sametime Meeting Room Client ST25PF1 - http://vcr.welchallyn.org/sametime/stmeeti...gRoomClient.cab
O16 - DPF: Sametime Meeting Room Client ST31 - http://meeting.eden.com/sametime/stmeeting...gRoomClient.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1097010793060
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://meeting.webex.com/client/v_meeting/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EDENAD.com
O17 - HKLM\Software\..\Telephony: DomainName = EDENAD.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{27E1FADB-B084-4EF9-A9E2-AE0C834265BB}: Domain = nycap.rr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EDENAD.com
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: LANDesk® Management Agent - Unknown - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Lotus Domino Server (LotusDominoData) - Unknown - C:\Lotus\Domino\nservice.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

#4 SirJon

SirJon

    Malware Prevention


  • Malware Response Team
  • 230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:15 AM

Posted 07 February 2005 - 11:12 AM

I can see from your latest log that you didn't follow the instructions. :thumbsup:

First, you need to move HijackThis.exe out of this directory:
C:\Documents and Settings\JPotash\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

First, I was unable to update the latest files for the escan antivirus toolkit.
Be patient, it is imperative you get the updated database to remove the various downloader trojan infections. It might take a hour, let it update, then follow the rest of the instructions to run the program.

I couldn't update the Ad-Aware with the latest definitions.
If you are using Ad-Aware 6, uninstall it and install Ad-Aware SE Personal then it should update normally. The direct link for the updated definition file is located here. The default path for Ad-Aware usually is C:\Program Files\Lavasoft\Ad-Aware SE Personal. You can extract the definition file and manually place it there.

As per the above instructions, you'll have to run these malware utilities from Safe Mode, due to the fact that they usually don't function properly when run in Windows. After downloading and installing all the prescribed removal programs, disconnect this PC from the Internet.

#5 eden517

eden517
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 08 February 2005 - 07:52 AM

OK, I was able to update the virus defs. I had to log in with someone with admin rights. I ran through everything. Here is the log. I ran it from the correct spot. Thank you.

Logfile of HijackThis v1.99.0
Scan saved at 7:18:48 AM, on 2/8/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eden.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eden.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {F2A4407B-FFBC-4A1F-A18A-0F68C3E0FC9E} - C:\WINDOWS\System32\jowiya.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: Sametime Meeting Room Client ST25PF1 - http://vcr.welchallyn.org/sametime/stmeeti...gRoomClient.cab
O16 - DPF: Sametime Meeting Room Client ST31 - http://meeting.eden.com/sametime/stmeeting...gRoomClient.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1097010793060
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://meeting.webex.com/client/v_meeting/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EDENAD.com
O17 - HKLM\Software\..\Telephony: DomainName = EDENAD.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{27E1FADB-B084-4EF9-A9E2-AE0C834265BB}: Domain = nycap.rr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EDENAD.com
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: LANDesk® Management Agent - Unknown - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Lotus Domino Server (LotusDominoData) - Unknown - C:\Lotus\Domino\nservice.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

#6 SirJon

SirJon

    Malware Prevention


  • Malware Response Team
  • 230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:15 AM

Posted 08 February 2005 - 09:39 AM

Now, please close ALL open windows AND browsers, open HijackThis and put checks next to all the following, then click "Fix Checked":

O2 - BHO: (no name) - {F2A4407B-FFBC-4A1F-A18A-0F68C3E0FC9E} - C:\WINDOWS\System32\jowiya.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)


EDENAD.COM = Cannot resolve hostsname

I notice from your handle (eden517) and your IE start page (http://www.eden.com) the name EDEN. You have (3) O17 TCPIP entries with the hostname EDENAD.COM, I can't resolve that hostname and I'm tempted to delete these entries but I'll ask you first if you know if they are connected to the eden.com company. If they are supposed to be there, we'll leave them.

These are not malware, but unneeded resource hogs; they are safe to delete in HJT also.
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

Now reboot the PC, open HijackThis, click on "Do a system scan and save and save a logfile", copy and paste the entire contents of the logfile here for review.

#7 eden517

eden517
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 08 February 2005 - 12:54 PM

EDENAD is legitimate. Let's leave it in. I did as you instructed and here is the latest logfile:

Logfile of HijackThis v1.99.0
Scan saved at 12:51:56 PM, on 2/8/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Lotus\Sametime Client\Connect.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\LDClient\LDISCN32.EXE
C:\Program Files\LivePerson\hc.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abosearch.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abosearch.com/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eden.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eden.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abosearch.com/index.html
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Sametime Connect] C:\Program Files\Lotus\Sametime Client\Connect.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [taskmngr] C:\WINDOWS\System32\taskmngr.exe
O4 - Startup: Inventory Scan.LNK = C:\LDClient\LDISCN32.EXE
O4 - Startup: Timpani.lnk = C:\Program Files\LivePerson\hc.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: Sametime Meeting Room Client ST25PF1 - http://vcr.welchallyn.org/sametime/stmeeti...gRoomClient.cab
O16 - DPF: Sametime Meeting Room Client ST31 - http://meeting.eden.com/sametime/stmeeting...gRoomClient.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1097010793060
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://meeting.webex.com/client/v_meeting/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EDENAD.com
O17 - HKLM\Software\..\Telephony: DomainName = EDENAD.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{27E1FADB-B084-4EF9-A9E2-AE0C834265BB}: Domain = nycap.rr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EDENAD.com
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: LANDesk® Management Agent - Unknown - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Lotus Domino Server (LotusDominoData) - Unknown - C:\Lotus\Domino\nservice.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

#8 SirJon

SirJon

    Malware Prevention


  • Malware Response Team
  • 230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:15 AM

Posted 08 February 2005 - 02:30 PM

EDENAD is legitimate.
Thank you! I'm glad I asked. It's strange the hostname couldn't be resolved though.

Now please close ALL open windows AND browsers and open HijackThis, click on “Do a system scan only” and put checks next to all the following, then click "Fix Checked"
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abosearch.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abosearch.com/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abosearch.com/index.html
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [taskmngr] C:\WINDOWS\System32\taskmngr.exe


You still have a trojan that needs to be deleted.

Please delete the following files and/or folders: Go to Start, Search, For Files or Folders, and type in each file or folder name.
C:\WINDOWS\System32\taskmngr.exe <----Delete this file.

Be very careful here, this is tricky. The bad file includes an 'n' in the spelling as in taskmngr.exe
The good file that is NOT to be deleted is spelled WITHOUT the 'n' as in taskmgr.exe

Now reboot the PC, open HijackThis, click on "Do a system scan and save and save a logfile", copy and paste the entire contents of the logfile here for review.

#9 eden517

eden517
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 08 February 2005 - 03:40 PM

I deleted the 5 items you listed. I searched for taskmngr.exe, but only found this- C:\windows\Prefetch\taskmngr.exe-064DDC55.pf I left it there and rebooted and ran scan and saved this log:

Logfile of HijackThis v1.99.0
Scan saved at 3:30:45 PM, on 2/8/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Lotus\Sametime Client\Connect.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\LDClient\LDISCN32.EXE
C:\Program Files\LivePerson\hc.exe
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eden.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eden.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Sametime Connect] C:\Program Files\Lotus\Sametime Client\Connect.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: Inventory Scan.LNK = C:\LDClient\LDISCN32.EXE
O4 - Startup: Timpani.lnk = C:\Program Files\LivePerson\hc.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: Sametime Meeting Room Client ST25PF1 - http://vcr.welchallyn.org/sametime/stmeeti...gRoomClient.cab
O16 - DPF: Sametime Meeting Room Client ST31 - http://meeting.eden.com/sametime/stmeeting...gRoomClient.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1097010793060
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://meeting.webex.com/client/v_meeting/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EDENAD.com
O17 - HKLM\Software\..\Telephony: DomainName = EDENAD.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{27E1FADB-B084-4EF9-A9E2-AE0C834265BB}: Domain = nycap.rr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EDENAD.com
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: LANDesk® Management Agent - Unknown - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Lotus Domino Server (LotusDominoData) - Unknown - C:\Lotus\Domino\nservice.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

#10 SirJon

SirJon

    Malware Prevention


  • Malware Response Team
  • 230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:15 AM

Posted 08 February 2005 - 05:04 PM

Nice work!
Your log looks good now. :thumbsup:

Please delete the following files and/or folders: Go to Start, Search, For Files or Folders, and type in each file or folder name.
C:\WINDOWS\System32\taskmngr.exe-064DDC55.pf <----Delete this file.

Edited by SirJon, 08 February 2005 - 05:06 PM.


#11 eden517

eden517
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 09 February 2005 - 09:19 AM

Thanks for all your help and patience. This adware/spyware is really becoming a nuisance. Like you didn't know that already! :thumbsup:

#12 SirJon

SirJon

    Malware Prevention


  • Malware Response Team
  • 230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:15 AM

Posted 09 February 2005 - 10:20 AM

You're Welcome! Thank you for your hard work! :flowers:

************************************************************
A few friendly :trumpet: tips to tighten security:

1.) Keep your Norton Antivirus up to date daily and run a hard drive scan once a week.

2.) STOP using Internet Explorer. Malware has gotten smarter these days and has the ability to change your IE security settings behind your back. Download and install Mozilla Firefox here Firefox weathers the storm of spyware better than IE because it is not integrated into Windows and does not support Active X.

3.) Download and install the free ZoneAlarm firewall here. For proper configuration click here. This program acts as a security gate and can help prevent the penetration of malware onto your system and prevent malware already present on your system from phoning home. A good 3rd party firewall always works better than the default Windows XP Service Pack 2 firewall.

4.) Install the Windows Security Updates. This includes Service Pack 2 for Windows XP, and Service Pack 4 for Windows 2000. Always make sure you have the latest Windows critical updates installed on your PC. Go to the Start menu, and click on 'Windows Update', it will take you to the Microsoft Windows Update site. If there are new critical updates to install, download them immediately. Once the installation process has completed, reboot your computer.

5.) Are you wondering how you got infected in the first place? For information click here.

Glad I could help you eden517, Good Luck. :thumbsup:

Edited by SirJon, 09 February 2005 - 10:21 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users