Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijck This, Check If Spyware Removed


  • This topic is locked This topic is locked
16 replies to this topic

#1 ghorfa91

ghorfa91

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 19 January 2006 - 03:21 AM

Hi can you check this log pls and tell me if spyware has been removed. Can i use the pc or shall i format?


Logfile of HijackThis v1.99.1
Scan saved at 09:17:29, on 19/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\winsysban.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Documents and Settings\Alan\Desktop\Hjt.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bov.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127116883796
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7E7CB61-8381-4FC5-93CB-21103B22B6B5}: NameServer = 212.56.128.132,212.56.128.196
O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

BC AdBot (Login to Remove)

 


#2 Grove

Grove

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 19 January 2006 - 04:36 AM

Hi and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

You may wish to Track this Topic via Options > Track This Topic so that you are notified when you receive a reply.

Please be patient with me during this time.

#3 Grove

Grove

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 20 January 2006 - 01:03 AM

Thanks for being so patient.

Hello and Welcome to BC,

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

MicroSoft AntiSpyware Program:

Because of recent changes in the way this program now defines and detects spyware/adware it is no longer recommend as a spyware removal tool. Microsoft has downgraded several adware/spyware programs that it used to detect and remove and now lists them simply as “Ignore”

These are some of the adware/spyware programs that this program will NOT prompt you to remove. Claria, 180Solutions, WhenU, New.net, most WhenU apps, eZula,TopText, Gain/Gator, and Webhancer. These are all known adware/spyware programs and hijackers. Basically this product can no longer be trusted to flag adware/spyware programs for removal!! I recommend you remove it or at the very least DO NOT solely depend on it for protection.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

MS AntiSpyware (MSAS) Beta
  • Right-click on the Microsoft Anti-Spyware icon in the system tray [it's the one with the red and yellow bulls-eye].
  • Click on "Security Agents Status".
  • Click on "Disable real-time protection".
  • Next right-click on the Microsoft Anti-Spyware icon in the system tray again to open Microsoft Anti-Spyware.
  • Click on the Options menu and choose Settings. In the left pane column click on "Real Time Protection".
  • Under Startup Options, uncheck "Enable (MSAS) Security Agents on startup (recommended)"
  • Under Real-time spyware threat protection, uncheck and "Enable real-time spyware threat protection" (recommended).
  • Click the Save button and close Microsoft AntiSpyware.
  • Finally, right-click on the MSAS icon in the system tray and select "Shutdown Microsoft Antispyware".
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).

Go into Hijack This->Config->Misc. Tools->Open process manager. Select the following and click “Kill process” for each one (If they still exist)(You must kill them one at a time).

C:\windows\winsysban.exe

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban.exe
O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll


Please remember to close all other windows, including browsers then click Fix checked.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\windows\winsysban.exe
C:\windows\winsysupd.exe
C:\WINDOWS\SYSTEM32\msupdate32.dll


* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Reboot your system in Normal Mode.

Perform an online scan with Internet Explorer with

Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Standard
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Take note the names and locations of any file it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

In your next post, please include fresh logs from:
  • HijackThis Log
  • Online Scan

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now.

#4 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 20 January 2006 - 05:40 AM

Thanls for replying Grove.

The following file could not be deleted C:\WINDOWS\SYSTEM32\msupdate32.dll

HIJACK THIS LOG FILE

Logfile of HijackThis v1.99.1
Scan saved at 09:34:23, on 20/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Documents and Settings\Alan\Desktop\Hjt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kav...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127116883796
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7E7CB61-8381-4FC5-93CB-21103B22B6B5}: NameServer = 212.56.128.132,212.56.128.196
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


KASPERSKY ONLINE SCAN


-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Friday, January 20, 2006 11:38:32
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 20/01/2006
Kaspersky Anti-Virus database records: 161574
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
G:\

Scan Statistics:
Total number of scanned objects: 52272
Number of viruses found: 24
Number of infected objects: 76
Number of suspicious objects: 2
Duration of the scan process: 9051 sec

Infected Object Name - Virus Name
C:\WINDOWS\system32\vmplay.dll Infected: Trojan-Downloader.Win32.Dyfuca.et
C:\WINDOWS\system32\txfdb32.dll Infected: Trojan-Downloader.Win32.Agent.rm
C:\WINDOWS\system32\srpcsrv32.dll Infected: Trojan-Downloader.Win32.Agent.rm
C:\WINDOWS\system32\paytime.exe Infected: Trojan.Win32.StartPage.ahf
C:\WINDOWS\system32\mspostsp.exe Infected: Trojan.Win32.Inject.i
C:\WINDOWS\system32\paradise.raw.exe Infected: Packed.Win32.Klone.b
C:\WINDOWS\msagent\win32\smss.exe Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\winlogon.exe Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\csrss.exe Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\zipedso1.ber/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\zipedso1.ber Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\zipedso2.ber/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\zipedso2.ber Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\zipedso3.ber/doc_data-text.txt .pif Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\zipedso3.ber Infected: Email-Worm.Win32.Sober.k
C:\WINDOWS\msagent\win32\winquert.exe Infected: Email-Worm.Win32.Sober.l
C:\WINDOWS\msagent\system\smss.exe Infected: Email-Worm.Win32.Sober.l
C:\WINDOWS\msagent\system\zipzip.zab/mail_text-data.txt .pif Infected: Email-Worm.Win32.Sober.l
C:\WINDOWS\msagent\system\zipzip.zab Infected: Email-Worm.Win32.Sober.l
C:\WINDOWS\msagent\system\mswebrun.exe Infected: Email-Worm.Win32.Sober.m
C:\WINDOWS\kl.exe Infected: Trojan-Spy.Win32.Small.dg
C:\WINDOWS\tool2.exe Infected: not-virus:Hoax.Win32.Renos.as
C:\WINDOWS\secure32.html Infected: Trojan.Win32.Harnig.a
C:\WINDOWS\tool3.exe Infected: Packed.Win32.Klone.b
C:\WINDOWS\tool4.exe Infected: Trojan.Win32.Dialer.u
C:\WINDOWS\drsmartload95a.exe Infected: Trojan-Downloader.Win32.Adload.j
C:\WINDOWS\loadadv728.exe Infected: Trojan-Downloader.Win32.PassAlert.n
C:\WINDOWS\runsvc32.exe Infected: Trojan-Dropper.Win32.Small.zp
C:\WINDOWS\inet20003\mm4.exe.bak Infected: Trojan-Proxy.Win32.Delf.an
C:\WINDOWS\inet20003\mm4.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\WINDOWS\inet20003\alg.exe.bak Infected: Email-Worm.Win32.Delf.i
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC4.zip/MTE3NDI6ODoxNg.exe Suspicious: Password-protected-EXE
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC4.zip Suspicious: Password-protected-EXE
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll Infected: Trojan-Spy.Win32.Small.dg
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll Infected: Trojan-Spy.Win32.Small.dg
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.dll Infected: Trojan-Spy.Win32.Small.dg
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00004.dll Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086054.exe Infected: Trojan-Downloader.Win32.PassAlert.n
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086055.exe/run.exe Infected: Trojan-Downloader.Win32.PassAlert.n
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086055.exe Infected: Trojan-Downloader.Win32.PassAlert.n
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086939.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086949.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086964.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086965.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086966.exe Infected: not-virus:Hoax.Win32.Renos.as
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086967.exe Infected: not-virus:Hoax.Win32.Renos.as
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086971.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086972.exe Infected: Trojan.Win32.Dialer.u
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086974.exe Infected: Trojan-Downloader.Win32.Tiny.al
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086977.exe Infected: Trojan.Win32.StartPage.ahf
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086980.exe Infected: Trojan-Downloader.Win32.PassAlert.n
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086983.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086991.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086997.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0087001.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0087997.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0088040.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0088045.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088050.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088051.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088052.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088056.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088060.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088065.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088072.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088076.exe Infected: Trojan-Proxy.Win32.Delf.an
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088079.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088080.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088083.exe Infected: Trojan-Downloader.Win32.CWS.s
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088084.exe Infected: not-virus:Hoax.Win32.Renos.as
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088085.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088089.sys Infected: SpamTool.Win32.Mailbot.k
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0088188.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091212.exe Infected: Packed.Win32.Klone.b
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091218.exe Infected: Trojan-Downloader.Win32.Tiny.al
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP498\A0092863.exe Infected: Trojan-Clicker.Win32.VB.kc
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP498\A0092864.exe Infected: Trojan.Win32.StartPage.ahg
C:\drsmartload1.exe Infected: Trojan-Downloader.Win32.VB.ut

Scan process completed.

#5 Ried

Ried

  • Malware Response Team
  • 1,009 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:41 AM

Posted 22 January 2006 - 01:04 AM

Hello ghorfa91,

Grove is away from the PC right now, and has asked me to step in. I am a Moderator/Security Analyst at Grove's home site.

Download and install Ewido Security Suite
  • When installing, under "Additional Options",
    • uncheck - Install background guard
  • Have Ewido update itself & then exit the program.
If you are having problems with the updater, you can use this link to manually update Ewido

Download smitRem.exe - extract it to it's own folder.

Please Download KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175)

---------------------------

Start KillBox.
Copy the file names below to the clipboard by highlighting them and pressing Ctrl-C:

**Note: You may have to split these into groups as all files may not fit at once. If you have to do them in groups, click NO at the Pending Operations Prompt until you've successfully entered the last file in the list.

C:\WINDOWS\system32\vmplay.dll
C:\WINDOWS\system32\txfdb32.dll
C:\WINDOWS\system32\srpcsrv32.dll
C:\WINDOWS\system32\paytime.exe
C:\WINDOWS\system32\mspostsp.exe
C:\WINDOWS\system32\paradise.raw.exe
C:\WINDOWS\msagent\win32\smss.exe
C:\WINDOWS\msagent\win32\winlogon.exe
C:\WINDOWS\msagent\win32\csrss.exe
C:\WINDOWS\msagent\win32\winquert.exe
C:\WINDOWS\msagent\system\smss.exe
C:\WINDOWS\msagent\system\mswebrun.exe
C:\WINDOWS\kl.exe
C:\WINDOWS\tool2.exe
C:\WINDOWS\tool3.exe
C:\WINDOWS\tool4.exe
C:\WINDOWS\drsmartload95a.exe
C:\WINDOWS\loadadv728.exe
C:\WINDOWS\runsvc32.exe
C:\WINDOWS\inet20003\mm4.exe.bak
C:\WINDOWS\inet20003\mm4.exe
C:\WINDOWS\inet20003\alg.exe.bak
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.dll
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00004.dll
C:\drsmartload1.exe
C:\WINDOWS\msagent\win32\zipedso1.ber
C:\WINDOWS\msagent\win32\zipedso2.ber
C:\WINDOWS\msagent\win32\zipedso3.ber
C:\WINDOWS\msagent\system\zipzip.zab


Go to the File menu, and choose Paste from Clipboard
*Click on the dropdown menu next to Full Path of File to Delete field.
*Verify that the filenames you pasted are found there
Select/tick the following:
* Delete on Reboot
* End Explorer Shell While Killing File
* Unregister.dll Before Deleting" if it's not grayed out.
Click the RED X button.

Click [Yes] at the 'Delete on Reboot' prompt. Click [Yes] at the Pending Operations prompt.

---------------------------

Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).

---------------------------

Open Hijack This and click on Scan. Check the following entry:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

Please remember to close all other windows, including browsers then click Fix checked.

---------------------------

Using Windows Explorer, navigate to and delete the following folder:

C:\WINDOWS\inet20003

---------------------------

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

---------------------------

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
  • Click Scanner
  • Click Complete System Scan to begin scanning.
  • Click OK when prompted to clean files
With the first file it prompts to clean, select the option:
  • "Perform action on all infections"
  • .Choose clean and click OK.
Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.

---------------------------

Reboot your system in Normal Mode.

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner
  • Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  • Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *
Begin the scan by selecting My Computer
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on See report then click Save report
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan


In your next post, please include fresh logs from:
  • HijackThis Log
  • Panda Results
  • Ewido Results
  • SmitFiles.txt

Edited by Ried, 22 January 2006 - 01:12 AM.

Microsoft MVP - Consumer Security 2010, 2011, 2012

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."


#6 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 24 January 2006 - 05:54 AM

Ried, here are the logs.


HIJACK THIS LOG FILE

Logfile of HijackThis v1.99.1
Scan saved at 11:00:06, on 24/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\Alan\Desktop\Hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bov.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kav...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127116883796
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7E7CB61-8381-4FC5-93CB-21103B22B6B5}: NameServer = 212.56.128.132,212.56.128.196
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



PANDA SOFTWARE ACTIVESCAN


Incident Status Location

Adware:adware/azesearch Not disinfected C:\WINDOWS\SYSTEM32\azebar.xml
Spyware:spyware/betterinet Not disinfected C:\WINDOWS\INF\satmat.inf
Adware:adware/twain-tech Not disinfected C:\WINDOWS\satmat.ini
Adware:adware/cws.searchmeup Not disinfected C:\WINDOWS\uniq
Adware:adware/cws Not disinfected C:\Documents and Settings\Alan\Favorites\Shop
Adware:adware/cydoor Not disinfected C:\WINDOWS\cdmxtras
Adware:adware/wupd Not disinfected Windows Registry
Potentially unwanted tool:application/funweb Not disinfected HKEY_CLASSES_ROOT\Interface\{1d4db7d3-6ec9-47a3-bd87-1e41684e07bb}
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Alan\Cookies\alan@xmts[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alan\Cookies\alan@belnk[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alan\Cookies\alan@dist.belnk[2].txt
Spyware:Spyware/BetterInet Not disinfected C:\WINDOWS\inf\satmat.inf
Adware:Adware/IPInsight Not disinfected C:\WINDOWS\satmat.ini
Joke:Joke/Stress Not disinfected Personal Folders\Outbox\Jokes\we should try this\Stress.dat
Joke:Joke/Stress Not disinfected C:\Documents and Settings\Alan\My Documents\OLD COMPUTER\My Download Files\Stress.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Alan\Desktop\smitRem.exe[Process.exe]
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Alan\Cookies\alan@xmts[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alan\Cookies\alan@belnk[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alan\Cookies\alan@dist.belnk[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Program Files\smitrem\smitRem\Process.exe
Adware:Adware/AzeSearch Not disinfected C:\hijackthis\backups\backup-20060117-110218-829.inf
Joke:Joke/Stress Not disinfected Personal Folders\Outbox\Jokes\we should try this\Stress.dat


EWIDO SCAN REPORT

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 10:56:06, 24/01/2006
+ Report-Checksum: 8A85B704

+ Scan result:

C:\WINDOWS\system32\msupdate32.dll -> Proxy.Agent.ij : Cleaned with backup
C:\WINDOWS\system32\chktrust.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\WINDOWS\NDNuninstall7_14.exe -> Adware.NewDotNet : Cleaned with backup
C:\WINDOWS\azesearch.bmp -> Adware.Azesearch : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@server.iad.liveperson[2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@microsofteup.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@web2.realtracker[2].txt -> Spyware.Cookie.Realtracker : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@cnn.122.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Alan\Cookies\alan@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Alan\Application Data\Mercora\MercoraClient\Data\MyPictures.dat -> Spyware.Grokster : Cleaned with backup
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086054.exe -> Downloader.PassAlert.n : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086939.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086949.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086964.exe -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086965.exe -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086966.exe -> Not-A-Virus.Hoax.Win32.Renos.al : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086967.exe -> Not-A-Virus.Hoax.Win32.Renos.al : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086971.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086972.exe -> Trojan.Dialer.u : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086974.exe -> Downloader.Tiny.al : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086977.exe -> Hijacker.StartPage.ahf : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086980.exe -> Downloader.PassAlert.n : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086983.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086991.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0086997.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0087001.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0087997.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0088040.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0088045.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP493\A0088048.dll -> Spyware.AzSearch : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088050.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088051.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088052.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088056.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088060.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088065.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088072.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088076.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088079.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP494\A0088080.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088083.exe -> Downloader.CWS.r : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088084.exe -> Not-A-Virus.Hoax.Win32.Renos.al : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088085.exe -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088089.sys -> Not-A-Virus.SpamTool.Win32.Mailbot.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088092.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP495\A0088102.dll -> Not-A-Virus.SpamTool.Win32.Mailbot.z : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0088188.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091203.exe -> Adware.NewDotNet : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091204.dll -> Spyware.AzSearch : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091208.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091212.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091218.exe -> Downloader.Tiny.al : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091253.dll -> Spyware.WildTangent : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP497\A0091264.dll -> Spyware.WildTangent : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP498\A0092863.exe -> Hijacker.VB.kc : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP498\A0092864.exe -> Hijacker.StartPage.ahg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094528.dll -> Downloader.Dyfuca.et : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094529.dll -> Downloader.Agent.rm : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094530.dll -> Downloader.Agent.rm : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094531.exe -> Hijacker.StartPage.ahf : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094532.exe -> Trojan.Inject.i : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094533.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094534.exe -> Worm.Sober.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094535.exe -> Worm.Sober.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094536.exe -> Worm.Sober.k : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094537.exe -> Worm.Sober.l : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094538.exe -> Worm.Sober.l : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094539.exe -> Worm.Sober.m : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094540.exe -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094541.exe -> Not-A-Virus.Hoax.Win32.Renos.al : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094542.exe -> Trojan.Small : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094543.exe -> Trojan.Dialer.u : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094544.exe -> Downloader.Adload.j : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094545.exe -> Downloader.PassAlert.n : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094547.exe -> Logger.Agent.ig : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094548.dll -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094549.dll -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094550.dll -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094551.dll -> Logger.Small.dg : Cleaned with backup
C:\System Volume Information\_restore{C4E301ED-551D-47A0-93DF-27BDB5860F66}\RP502\A0094552.exe -> Downloader.VB.ut : Cleaned with backup


::Report End



SMITHFILES.TXT



smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: 24/01/2006
The current time is: 10:31:00.10

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~

Install.dat


~~~ Favorites ~~~



~~~ system32 folder ~~~

svcp.csv


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~

secure32.html


~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1396 'explorer.exe'

Starting registry repairs

Deleting files


Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN! :thumbsup:



THANKS A LOT. PLEASE GET BACK.


ALAN

#7 sUBs

sUBs

    sUBs


  • Malware Response Team
  • 2,489 posts
  • OFFLINE
  •  
  • Local time:06:41 PM

Posted 24 January 2006 - 07:29 AM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.


* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *


Right click on this & choose "Save As..." DelO15Domains.inf - DelO15Domains.inf
Right click on DelO15Domains.inf and choose Install. It will run immediately (you won't be able to see anything happen). You may delete the file afterwards.

Host.zip - From within Host.zip, double click on MVPS.bat & allow it to run.

Right click on this & select 'Save As' - DNSManual.bat
Doubleclick on DNSManual.bat & allow it to run.

SpywareBlaster 3.5.1
Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

IE-SpyAD - Extract the contents to a new folder
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list.
Then return to the main menu.
Select option #4 - Add the old porn sites domain

Download the file attached - [attachment=693:attachment]
Double click on the file within & allow it to merge into the Registry
It will remove malware entries from the Registry


* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * *


Do a HijackThis scan & place a check next to these items and select "Fix checked":

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)


* * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * *


If you have not done so already, please enable the viewing of Hidden files
From Windows Explorer, go to Tools -> Folder Options -> View tab.
  • Tick - 'Show hidden files and folder'
  • Untick - 'Hide file extensions for known types'
  • Untick - 'Hide protected operating system files'
  • Click Yes to confirm & then click OK
Locate and delete the following files/folders: (let me know if you fail to find/delete any)
  • C:\WINDOWS\SYSTEM32\azebar.xml
    C:\WINDOWS\INF\satmat.inf
    C:\WINDOWS\satmat.ini
    C:\WINDOWS\uniq
    C:\Documents and Settings\Alan\Favorites\Shop
    C:\WINDOWS\cdmxtras
    C:\Documents and Settings\Alan\Cookies\alan@xmts[1].txt
    C:\Documents and Settings\Alan\Cookies\alan@belnk[1].txt
    C:\Documents and Settings\Alan\Cookies\alan@dist.belnk[2].txt
    C:\Documents and Settings\Alan\Cookies\alan@xmts[1].txt
    C:\Documents and Settings\Alan\Cookies\alan@belnk[1].txt
    C:\Documents and Settings\Alan\Cookies\alan@dist.belnk[2].txt
* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *


Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:
  • Delete Newsgroup cache
  • Delete Newsgroup Subscriptions
  • Scan local drives for temporary files
4. Click OK
5. Press the CleanUp! button to start the program.


Post a new HJT log & tell us how the machine is behaving now.

Edited by sUBs, 24 January 2006 - 08:09 AM.


#8 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 24 January 2006 - 08:52 AM

arrived to the point where i have to do the hijack this scan.

IT IS STOPPING FOR ME ON O15-TRUSTED ZONE ENUMERTION.

THE PROGRAM STOPS RESPONDING.

#9 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 24 January 2006 - 08:53 AM

IGNORE POST JUST SENT RE: HIJACK NOT RESPONDING.

#10 sUBs

sUBs

    sUBs


  • Malware Response Team
  • 2,489 posts
  • OFFLINE
  •  
  • Local time:06:41 PM

Posted 24 January 2006 - 08:56 AM

SpywareBlaster & IE-SpyAD placed alot of entries into the 015 range. Hijakthis would appear to be not responding as it requires a bit of time to enumerate all those entries.

#11 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 24 January 2006 - 09:00 AM

WHAT IS CLEANUP



ALAN

#12 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 24 January 2006 - 10:30 AM

WHAT IS CLEANUP PLEASE, SO THAT I MAY CONTINUE

#13 sUBs

sUBs

    sUBs


  • Malware Response Team
  • 2,489 posts
  • OFFLINE
  •  
  • Local time:06:41 PM

Posted 25 January 2006 - 09:23 AM

That's strange. I didnt receive notifications of any replies from you.

CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

#14 ghorfa91

ghorfa91
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:12:41 PM

Posted 25 January 2006 - 09:45 AM

Hi sUBs


Logfile of HijackThis v1.99.1
Scan saved at 15:40:54, on 25/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\Alan\Desktop\Hjt.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bov.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.7\PlaxoHelper.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127116883796
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7E7CB61-8381-4FC5-93CB-21103B22B6B5}: NameServer = 212.56.128.132,212.56.128.196
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


THANKS FOR NOW. GIVE ME FEEDBACK.

#15 sUBs

sUBs

    sUBs


  • Malware Response Team
  • 2,489 posts
  • OFFLINE
  •  
  • Local time:06:41 PM

Posted 25 January 2006 - 11:30 AM

Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:
  • CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
    Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
    • Tick on the checkbox - Turn off System Restore on all drives
    • Click Apply
    Turn it back 'On' by unticking the same checkbox & click OK


  • DISABLE THE VIEWING OF SYSTEM FILES
    From Windows Explorer, go to Tools>Folder Options> View tab.
    • Untick - Show hidden files and folder
    • Tick - Hide file extensions for known types
    • Tick - Hide protected operating system files
    Click Yes to confirm & then click OK


  • SECURING INTERNET EXPLORER
    From within Internet Explorer click on the Tools menu and then click on Internet Options.
    • Select the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Select Custom Level .
        • Change 'Download signed ActiveX controls' to Prompt
        • Change 'Download unsigned ActiveX controls' to Disable
        • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
        • Change 'Installation of desktop items' to Prompt
        • Change 'Launching programs and files in an IFRAME' to Prompt
        • Change 'Navigate sub-frames across different domains' to Prompt
        • When all these changes have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Select OK to exit the Internet Properties page.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

    It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


  • FIREWALL
    Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.


  • Microsoft Windows Update
    Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


  • SPYBOT - SEARCH & DESTROY
    Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


  • AD-AWARE
    Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
  • Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • Google Toolbar - Get the free google toolbar to help stop pop up windows.

  • CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

  • Winpatrol - Download and install the free version of Winpatrol.
    A tutorial for this product is located here:
    Using Winpatrol to protect your computer from malicious software
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day. Posted Image

Please respond to this thread one more time so we can mark this thread as resolved.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users