Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Yet Another "remove The Inqwire Popups" Job...


  • Please log in to reply
5 replies to this topic

#1 i-Zapp

i-Zapp

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 26 November 2005 - 02:09 PM

My machine is plagued with inqwire popups, as well as very slow performance. I've followed the preparation and have posted my hijackthis scan results. As far as mcafee, norton, and adaware is concerned the machine is clean, yet I still get the incessant inqwire (and other) popups.

What is my next step? Thanks in advance for the support.

Logfile of HijackThis v1.99.1
Scan saved at 2:00:20 PM, on 11/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINNT\GWHotKey.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\System32\Ati2evxx.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Money\System\mnyschdl.exe
C:\Program Files\Microsoft Money\System\misuser.exe
C:\Program Files\Microsoft Money\System\mis.exe
C:\WINNT\System32\5n0izk9.exe
C:\WINNT\System32\5n0izk9.exe
C:\WINNT\System32\5n0izk9.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7A1693A1-AFAF-4F1E-9B05-EEC38A85FBF3} - C:\WINNT\system32\7x39n1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600"
O4 - HKLM\..\RunOnce: [wxyxcog.exe] C:\WINNT\System32\wxyxcog.exe /k
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [wxyxcog.exe] C:\WINNT\System32\wxyxcog.exe /k
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122292814212
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130373911077
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe


BC AdBot (Login to Remove)

 


m

#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:11:29 PM

Posted 27 November 2005 - 05:01 AM

Hi and Welcome to bleeping computer!! Posted Image

My name is David Posted Image

Please do both of the following before we start if possible!:

1) Please print off these intructions - they will be needed later when internet access is not available.
2) Save these instructions in word/notepad to the desktop where they can be easily found for the same reasons as above.

There is a bit to do on the log - i can almost guaruntee ewido will remove something - it's also a good free tool to keep in your arsenal! :thumbsup:

Please download ewido security suite it is a free version of the program.
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck.
    • Install background guard
    • Install scan via context menu
  • Launch ewido, there should be an icon on your desktop, double-click it.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  • You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display ("Update successful") Posted Image
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • You will be prompted to clean the first infection.
  • Select "Perform action on all infections", then proceed.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop or a location where you can find it easily.
Close ewido security suite.

Post a new HJT log and the ewido log at the end! :flowers:
David

#3 i-Zapp

i-Zapp
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 27 November 2005 - 10:27 PM

Well, before trying the above approach (silly me) I tried all the other tried and true methods including calling my brother in law, the pro IS guy. Adaware found nothing. Spybot nothing. Trendmicro found a bunch, but the extermination wouldnt last. Popups were back.

So i decided to run the ewido program. Over an hour later, it reported over 70 high risk trojans, parasites, etc. The results are posted below. I'd post the hijackthis report, but really it's nearly identical except for the
"C:\WINNT\System32\5n0izk9.exe" entries.

here's the ewido report... My laymen's analysis is that the 'Trojan.Kolweb.f' entry is the culprit.
Time will tell, but I have a good feeling about this. I'll report back one way or the other in a week.

---------------------------------------------------------
 ewido security suite - Scan report
---------------------------------------------------------

 + Created on:			10:02:00 PM, 11/27/2005
 + Report-Checksum:		995D1A69

 + Scan result:

	HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
	HKLM\SOFTWARE\Classes\TypeLib\{014DA6C0-189F-421A-88CD-07CFE51CFF10} -> Spyware.BargainBuddy : Cleaned with backup
	HKLM\SOFTWARE\DelFin -> Spyware.Delfin : Cleaned with backup
	HKLM\SOFTWARE\DelFin\PromulGate -> Spyware.Delfin : Cleaned with backup
	HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{014DA6C9-189F-421a-88CD-07CFE51CFF10} -> Spyware.MySearch : Cleaned with backup
	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer -> Spyware.Delfin : Cleaned with backup
	HKU\S-1-5-21-1810525741-3598173642-3481483333-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{014DA6C9-189F-421A-88CD-07CFE51CFF10} -> Spyware.MySearch : Cleaned with backup
	[3380] C:\WINNT\system32\7x39n1.dll -> Trojan.Kolweb.f : Cleaned with backup
	[1092] C:\WINNT\system32\7x39n1.dll -> Trojan.Kolweb.f : Error during cleaning
	C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[3].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ads.addynamix[2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@targetnet[1].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@valuead[2].txt -> Spyware.Cookie.Valuead : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
	C:\Documents and Settings\Owner\Local Settings\Temp\8qi9.sys -> Trojan.Kolweb.g : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall4_50.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall4_80.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall5_20.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall5_40.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall5_64.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall6_10.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall6_22.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall6_30.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/WINNT/NDNuninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/Program Files/newdotnet/newdotnet6_38.dll -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/Program Files/newdotnet/uninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/Program Files/newdotnet/newdotnet6_38.to_be_deleted -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/Program Files/newdotnet/uninstall5_40.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\Program Files\Yahoo!\YPSR\Quarantine\20051003203044.zip/Program Files/newdotnet/newdotnet6_38.to_be_deleted_x -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP390\A0032823.exe -> Trojan.Kolweb.e : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP390\A0032839.exe -> TrojanDownloader.Delf.go : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033175.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033176.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033179.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033180.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033182.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033183.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033184.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033185.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033186.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033187.dll -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033188.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033189.exe -> Spyware.NewDotNet : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP393\A0033210.dll -> Trojan.Kolweb.d : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP397\A0034236.sys -> Trojan.Kolweb.e : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP397\A0034237.exe -> Trojan.Kolweb.e : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP397\A0034238.sys -> Trojan.Kolweb.e : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP398\A0034265.dll -> Trojan.Kolweb.d : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP428\A0034966.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP428\A0034967.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP434\A0035278.exe -> TrojanDropper.Small.ky : Cleaned with backup
	C:\System Volume Information\_restore{1920DD05-C3B3-4337-B7AE-8CBB7597E6CD}\RP434\A0035294.DLL -> Spyware.MyWay : Cleaned with backup
	C:\WINNT\8qi9.sys -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
	C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll -> Spyware.Yahoo : Cleaned with backup
	C:\WINNT\system32\5n0izk9.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\7x39n1.dll -> Trojan.Kolweb.f : Cleaned with backup
	C:\WINNT\system32\8qi9.sys -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\wxyxcog.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\wt\wtvh.dll -> Spyware.WildTangent : Cleaned with backup


::Report End


#4 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:11:29 PM

Posted 30 November 2005 - 03:48 PM

Good job - can i have a new HJT log also
David :thumbsup:

#5 i-Zapp

i-Zapp
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:29 PM

Posted 04 December 2005 - 09:28 PM

was doing ok for almost a week, then my wife tells me "they're backkkkk...."

did another ewido scan and found a whole bunch more. seems this Trojan.Kolweb.f thing is the culprit. dunno if the sites she's visiting (or the kids) are reinfecting, or if ewido isn't doing a complete vaccination.

here's the ewido scan as well as hijackthis -

+ Scan result:

	[3996] C:\WINNT\system32\4h1rb.dll -> Trojan.Kolweb.f : Cleaned with backup
	C:\WINNT\0alxtn.sys -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\0alxtn.sys -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\4h1rb.dll -> Trojan.Kolweb.f : Cleaned with backup
	C:\WINNT\system32\4zaz0q.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\5n0izk9.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\reg32mon.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\WINNT\system32\vixi.exe -> Trojan.Kolweb.g : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@adopt.specificclick[1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ads.addynamix[1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@as-us.falkag[2].txt -> Spyware.Cookie.Falkag : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@as1.falkag[2].txt -> Spyware.Cookie.Falkag : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ehg-legonewyorkinc.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@ehg-nestleusainc.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@revenue[1].txt -> Spyware.Cookie.Revenue : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@targetnet[2].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@twci.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
	C:\Documents and Settings\Owner\Cookies\owner@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup

Logfile of HijackThis v1.99.1
Scan saved at 9:24:59 PM, on 12/4/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft Works\MSWorks.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Money\System\mnyschdl.exe
C:\Program Files\Microsoft Money\System\misuser.exe
C:\Program Files\Microsoft Money\System\mis.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ewido\security suite\SecuritySuite.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7A1693A1-AFAF-4F1E-9B05-EEC38A85FBF3} - C:\WINNT\system32\4h1rb.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122292814212
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130373911077
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe


#6 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:11:29 PM

Posted 05 December 2005 - 04:15 PM

Download WinPFind!
  • Extract WinPFind.zip to your c:\ folder.
  • Reboot your computer into Safe Mode
  • Then open c:\WinPFind and double-click on WinPFind.exe.
  • When the program is open, click on the Start Scan button to start scanning your computer.
  • Be patient as this scan may take a while. When it is done, it will show a log and tell you the scan is completed.
  • Reboot your computer back to normal mode and and post the contents of c:\WinPFind\WinPFind.txt as a reply to this topic.
No need to post in code

David




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users