Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

New to the site. Need expert help


  • This topic is locked This topic is locked
11 replies to this topic

#1 Ihatecomputers

Ihatecomputers

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 09 March 2005 - 03:36 PM

Please help me get rid ot all the garbage in my computer.

Thanks

Logfile of HijackThis v1.99.0
Scan saved at 7:00:26 PM, on 3/2/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\jon\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll/sp.html
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] "c:\PROGRA~1\mcafee.com\agent\mcagent.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [PopUpWasher] C:\PROGRA~1\Webroot\POP-UP~1\PopUpWasher.exe
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\Bin\HPOstr05.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O18 - Filter: text/html - {9258216E-D15F-4F90-9BE5-C9E814CD2BE9} - C:\WINNT\system32\jclgc.dll
O18 - Filter: text/plain - {9258216E-D15F-4F90-9BE5-C9E814CD2BE9} - C:\WINNT\system32\jclgc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

:thumbsup: :flowers:

BC AdBot (Login to Remove)

 


#2 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:34 AM

Posted 09 March 2005 - 04:28 PM

Hello Ihatecomputers and welcome to BleepingComputer.


Please download the Backdoor.Agent.B Removal Tool to your desktop.

- Shut down all running programs, disconnect from the internet and run the tool.
- Save the log it makes for posting in your next reply.


Please download DLLCompare.exe to your desktop.
http://www.bleepingcomputer.com/files/dllcompare.php.

Double click on DLLCompare.exe to run the program. When it is open, click on the Run Locate.com button. When that has completed, click on the Compare button and then finally on the Make Log button. Post the contents of the resulting log as a reply to this topic.


In addition to the above two logs, also post a fresh HJT log.
Derfram
~~~~~~

#3 Ihatecomputers

Ihatecomputers
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 09 March 2005 - 08:46 PM

Thank you so much for answering my e-mail.

I followed your e-mail

1) Ran Backdoor.Agent.B Removal Tool
2) Log enclosed
3) Backdoor.Agent.B Removal Tool asked me to restart my computer, which I did.
4) Ran DLLCompare.exe
5) It came with the following error message:

C:\Docume~1\Jon\Desktop\Locate.com
C:\Winnt|System32\Autoexec.nt
The system file is not suitable for running MS-DOS and Microsoft Windows applications.
Choose 'Close' to terminate the application
6) Which I did
7) Ran HJT, file enclosed
8) Note that when trying to fix the problem myself, I renamed some Se.dll files/registrers to se.dllbadfile, in safe mode. Some stayed changed, some came back as the old ugly.


Thanks again.

Jon



Symantec Backdoor.Agent.B Removal Tool 1.0.1.2

process: WINLOGON.EXE, thread: 000000E4 (terminated)
process: SERVICES.EXE, thread: 0000011C (terminated)
process: LSASS.EXE, thread: 00000120 (terminated)
process: svchost.exe, thread: 000001CC (terminated)
process: spoolsv.exe, thread: 00000200 (terminated)
process: svchost.exe, thread: 00000228 (terminated)
process: nvsvc32.exe, thread: 00000260 (terminated)
process: regsvc.exe, thread: 0000026C (terminated)
process: mstask.exe, thread: 00000298 (terminated)
process: stisvc.exe, thread: 00000314 (terminated)
process: WinMgmt.exe, thread: 00000338 (terminated)
process: svchost.exe, thread: 00000318 (terminated)
process: explorer.exe, thread: 000003E0 (terminated)
process: wcescomm.exe, thread: 00000460 (terminated)
process: rundll32.exe, thread: 00000480 (terminated)
process: WINWORD.EXE, thread: 0000049C (terminated)
process: FxAgentB.exe, thread: 000005F4 (terminated)

registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: AppInit_DLLs (value set to "")

C:\System Volume Information: (not scanned)
C:\WINNT\system32\wdmcfhf.dll: (will be deleted on next reboot)

The Backdoor.Agent.B removal was successful.
The system will delete 1 Backdoor.Agent.B files from your PC on next reboot.

Here is the report:

1 file(s) could not be deleted.
They will be deleted on next reboot.

The total number of the scanned files: 52274
The number of deleted files: 0
The number of viral processes terminated: 0
The number of viral threads terminated: 17
The number of registry entries fixed: 1

The tool initiated a system reboot.




Logfile of HijackThis v1.99.0
Scan saved at 7:00:26 PM, on 3/2/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\jon\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll/sp.html
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] "c:\PROGRA~1\mcafee.com\agent\mcagent.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [PopUpWasher] C:\PROGRA~1\Webroot\POP-UP~1\PopUpWasher.exe
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\Bin\HPOstr05.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O18 - Filter: text/html - {9258216E-D15F-4F90-9BE5-C9E814CD2BE9} - C:\WINNT\system32\jclgc.dll
O18 - Filter: text/plain - {9258216E-D15F-4F90-9BE5-C9E814CD2BE9} - C:\WINNT\system32\jclgc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

#4 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:34 AM

Posted 09 March 2005 - 08:59 PM

Download 16bit_fix.exe to your desktop from here. Run 16bit_fix.exe.

Then try running DLLCompare again.
Derfram
~~~~~~

#5 Ihatecomputers

Ihatecomputers
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 09 March 2005 - 09:14 PM

Thank you for a quick reply

1) Downloaded and ran 16bit_fix.exe
2) Disconnected from internet and closed all running programs
3) Ran DLLCompare.exe
4) Here is the log

* DLLCompare Log version(1.0.0.125)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

O^E says: "There were no files found :thumbsup:"
________________________________________________

1,195 items found: 1,195 files, 0 directories.
Total of file sizes: 259,525,822 bytes 247.50 M

Administrator Account = True

--------------------End log---------------------


6) Note: the program listed lots of dll files when it ran, but all I got was the log above.

Thanks again

Jon

#6 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:34 AM

Posted 09 March 2005 - 09:24 PM

Configure Windows to enable viewing of Hidden and System files.


Start HJT and click on the SCAN button. Put a check mark in front of the following lines if they still show:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll/sp.html

O18 - Filter: text/html - {9258216E-D15F-4F90-9BE5-C9E814CD2BE9} - C:\WINNT\system32\jclgc.dll
O18 - Filter: text/plain - {9258216E-D15F-4F90-9BE5-C9E814CD2BE9} - C:\WINNT\system32\jclgc.dll

With ALL OTHER WINDOWS CLOSED, click on Fix Checked.


Open Windows Explorer (Windows key+e), navigate to and delete the following files if found:

C:\DOCUME~1\jon\LOCALS~1\Temp\se.dll
C:\WINNT\system32\jclgc.dll

If any of these resist being deleted, boot into Safe Mode and try from there.


Reboot normally and post a new HJT log please.
Derfram
~~~~~~

#7 Ihatecomputers

Ihatecomputers
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 11 March 2005 - 08:24 PM

It looks like it is working.

Here is the HJT log. Let me know if you find anything. Had to go to safe mode to be able to delete the se.dll file. I tryed to do delte the se.dll files in safe mode before, but they came back after a while. However, I did not do all of the other steps you told me.

Thanks a million for your help.

I should probably change my user name to ILOVECOMPUTERS.

Jon

Logfile of HijackThis v1.99.0
Scan saved at 8:23:19 PM, on 3/11/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\Bin\HPOstr05.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\bin\HPOVDX05.EXE
C:\WINNT\system32\hpoipm07.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\jon\Desktop\HijackThis.exe

O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\Bin\HPOstr05.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - {07231D39-5750-4734-8818-27D22D144974} - C:\WINNT\system32\plpjo.dll
O18 - Filter: text/plain - {07231D39-5750-4734-8818-27D22D144974} - C:\WINNT\system32\plpjo.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

#8 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:34 AM

Posted 11 March 2005 - 11:52 PM

Use HijackThis to remove the following lines:

O18 - Filter: text/html - {07231D39-5750-4734-8818-27D22D144974} - C:\WINNT\system32\plpjo.dll
O18 - Filter: text/plain - {07231D39-5750-4734-8818-27D22D144974} - C:\WINNT\system32\plpjo.dll


Post one more fresh log.
Derfram
~~~~~~

#9 Ihatecomputers

Ihatecomputers
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 12 March 2005 - 05:05 PM

New hjt file below.

I did a google search on plpjo.dll, but found nothing. Also tried to find it using registrar lite, nothing. What is this dll?

Thanks again for your help

Logfile of HijackThis v1.99.0
Scan saved at 5:06:55 PM, on 3/12/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\Bin\HPOstr05.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\bin\HPOVDX05.EXE
C:\WINNT\system32\hpoipm07.exe
C:\Documents and Settings\jon\Desktop\HijackThis.exe

O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600 NT\Bin\HPOstr05.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

Jon

#10 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:34 AM

Posted 13 March 2005 - 12:02 AM

I did a google search on plpjo.dll, but found nothing. Also tried to find it using registrar lite, nothing. What is this dll?

It's a randomly named file that is a remnant of the se.dll about:blank infection you had.



Now that you are clean, please follow these steps in order to keep your computer safe and secure:

Simple and easy ways to keep your computer safe and secure on the Internet
Derfram
~~~~~~

#11 Ihatecomputers

Ihatecomputers
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:34 AM

Posted 13 March 2005 - 12:14 AM

Thanks a million for all your help

Regards,

ILOVECOMPUTERS.

#12 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:34 AM

Posted 17 March 2005 - 10:22 PM

Since your problem appears to be resolved, this thread will now be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.
Derfram
~~~~~~




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users