Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With Coolweb Search And Spy Sheriff...help!


  • This topic is locked This topic is locked
8 replies to this topic

#1 Rivercollin

Rivercollin

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 30 January 2006 - 08:15 PM

Hi there...can anyone help me with a "spyware for dummies" course? I've run multiple deep scans with Microsoft Antispyware, Ad-Aware, and Spybot and I can't get rid of coolwebsearch or spy sheriff...I'm ready to take it to the local Geek Squad, but am kinda low on cash. Can anyone help me? here is my Hijack this log: Logfile of HijackThis v1.99.1
Scan saved at 6:36:39 PM, on 1/30/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Gateway Utilities\GWInkMonitor.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\apirn.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINNT\system32\mfcpr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\taskmgr.exe
C:\Documents and Settings\Administrator\My Documents\My Received Files\Hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe"
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {B935E405-5B79-D0C9-A677-F93E33BCDD28} - C:\WINNT\iepr.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [cleaner] lib.exe
O4 - HKLM\..\Run: [javahk.exe] C:\WINNT\system32\javahk.exe
O4 - HKLM\..\Run: [E.tmp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E.tmp.exe
O4 - HKLM\..\Run: [F.tmp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [E.tmp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E.tmp.exe
O4 - HKLM\..\Run: [F.tmp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp.exe
O4 - HKLM\..\Run: [nthw.exe] C:\WINNT\system32\nthw.exe
O4 - HKLM\..\Run: [apiwn.exe] C:\WINNT\system32\apiwn.exe
O4 - HKLM\..\Run: [iewi32.exe] C:\WINNT\iewi32.exe
O4 - HKLM\..\Run: [ntaa32.exe] C:\WINNT\ntaa32.exe
O4 - HKLM\..\Run: [d3ro.exe] C:\WINNT\system32\d3ro.exe
O4 - HKLM\..\Run: [apiya32.exe] C:\WINNT\system32\apiya32.exe
O4 - HKLM\..\Run: [mfcpr.exe] C:\WINNT\system32\mfcpr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

Thanx for the help in advance!!

BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:12 PM

Posted 31 January 2006 - 08:23 AM

Hello,

It's better to print out the next instructions or save it in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.
It is also important you don't miss a step and perform everything in the right order!!

° Download AboutBuster.
Unzip AboutBuster.
Read here how to unzip/extract properly:
http://metallica.geekstogo.com/xpcompressedexplanation.html
You may not run it aboutbuster yet, that's for later.

* Download and install CCleaner
Do not use it yet.

* Please download Ewido anti-malware ; it is a free version of the program.
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck..
    • Install background guard
    • Install scan via context menu
  • Launch ewido by double-clicking on the icon on your desktop.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  • You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display ("Update successful")
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates
Don't run it yet.

We also need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes.

Open Microsoft AntiSpyware.
Click on Tools, Settings.
In the left pane, click on Real-time Protection.
Under Startup Options uncheck: Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
Under Real-time spyware threat protection uncheck: Enable real-time spyware threat protection (recommended).
After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

* Please reboot your system into SAFE MODE.
°To get into the Windows XP Safe mode as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu". Use your arrow keys to move to "Safe Mode" and press your Enter key.

* Start hijackthis and click scan and put a checkmark next to the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\yejwa.dll/sp.html#47254%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe"
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {B935E405-5B79-D0C9-A677-F93E33BCDD28} - C:\WINNT\iepr.dll
O4 - HKLM\..\Run: [cleaner] lib.exe
O4 - HKLM\..\Run: [javahk.exe] C:\WINNT\system32\javahk.exe
O4 - HKLM\..\Run: [E.tmp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E.tmp.exe
O4 - HKLM\..\Run: [F.tmp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp.exe
O4 - HKLM\..\Run: [E.tmp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E.tmp.exe
O4 - HKLM\..\Run: [F.tmp.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\F.tmp.exe
O4 - HKLM\..\Run: [nthw.exe] C:\WINNT\system32\nthw.exe
O4 - HKLM\..\Run: [apiwn.exe] C:\WINNT\system32\apiwn.exe
O4 - HKLM\..\Run: [iewi32.exe] C:\WINNT\iewi32.exe
O4 - HKLM\..\Run: [ntaa32.exe] C:\WINNT\ntaa32.exe
O4 - HKLM\..\Run: [d3ro.exe] C:\WINNT\system32\d3ro.exe
O4 - HKLM\..\Run: [apiya32.exe] C:\WINNT\system32\apiya32.exe
O4 - HKLM\..\Run: [mfcpr.exe] C:\WINNT\system32\mfcpr.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)


* Close all open windows except hijackthis and click 'Fix Checked'.

* Navigate to and delete the following files if present:

C:\WINNT\apirn.exe
C:\WINNT\system32\mfcpr.exe
C:\WINNT\system32\javahk.exe
C:\WINNT\system32\nthw.exe
C:\WINNT\system32\apiwn.exe
C:\WINNT\iewi32.exe
C:\WINNT\ntaa32.exe
C:\WINNT\system32\d3ro.exe
C:\WINNT\system32\apiya32.exe

* Start Aboutbuster and let it scan.
The log will be saved in the aboutbuster-folder
If you get any error using aboutbuster, it's important you let me know afterwards in your next reply.
So skip this step in case of error and proceed with the next step of this fix.

* Still in safe mode start Ccleaner.
click "Options", click the "Advanced" tab
Uncheck: "Only delete files older than 48 hrs.", click Ok
Click "Cleaner" and click Run Cleaner (bottom right)

* Now open Ewido anti-malware
Click on scanner

* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop

* Close Ewido

* Reboot your PC back to normal.

* Perform an onlinescan with panda: (please use this scanner instead of any other scanner!)
Panda Online
- Once you are on the Panda site click the Scan your PC button
- A new window will open...click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the Panda scan report in your next reply together with a new hijackthis-log
+ log from ewido and the aboutbuster-log which will be present in the aboutbuster-folder.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 Rivercollin

Rivercollin
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 31 January 2006 - 10:03 PM

Hi...I think I still have some spyware because there's a red circle with an exclamation point in my taskbar. Will a simple spybot or ad-aware scan clear the last of it? Anyway, here's my Panda, HiJack, Ewido, and the aboutbuster logs.

Ewido:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 7:52:49 PM, 1/31/2006
+ Report-Checksum: 331707A4

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4BBD2287-F0E7-66FA-233E-B3208A2D566F} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Uninstall\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Cleaned with backup
C:\Documents and Settings\Administrator\My Documents\My Received Files\Hijackthis\backups\backup-20060131-182445-440.dll -> Downloader.Agent.bc : Cleaned with backup
C:\ntzl.exe -> Trojan.LowZones.df : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011602.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011621.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011636.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011643.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011764.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011770.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011783.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011787.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011803.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011808.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011817.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011835.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011840.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011855.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011867.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011884.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011899.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011905.exe -> Not-A-Virus.Hoax.Win32.Renos.au : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0011923.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012057.pif:rcwmo -> Downloader.Agent.bc : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012060.ini:iagnx -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012070.dll -> Downloader.Agent.bc : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012072.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012073.ini:iagnx -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012074.ini:odykc -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012077.pif:rcwmo -> Downloader.Agent.bc : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012078.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012079.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012080.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012081.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012082.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012083.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012084.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012085.exe -> Downloader.Agent.td : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012086.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012087.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012088.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012089.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012090.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012091.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012092.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012093.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012095.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012096.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012097.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012098.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012099.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012100.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012101.exe -> Trojan.Agent.bi : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012102.dll -> Hijacker.Small : Cleaned with backup
C:\System Volume Information\_restore{657CAD57-1780-47DF-A227-8D19F3156604}\RP79\A0012108.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINNT\system32\lib.exe -> Trojan.LowZones.df : Cleaned with backup


::Report End

Hijack:Logfile of HijackThis v1.99.1
Scan saved at 8:52:26 PM, on 1/31/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Gateway Utilities\GWInkMonitor.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\System32\intell321.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\My Documents\My Received Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [intell321.exe] C:\WINNT\System32\intell321.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

Panda:

Incident Status Location

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt
Spyware:spyware/smitfraud Not disinfected C:\WINNT\system32\oleext.dll

Aboutbuster:
AboutBuster 6.0
Scan started on [1/31/2006] at [6:37:47 PM]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
Removed Stream! C:\WINNT\desktop.ini:iagnx
Removed Stream! C:\WINNT\KB828035.log:etkbi
Removed Stream! C:\WINNT\KB888113.log:jzsvsf
Removed Stream! C:\WINNT\KB890859.log:cakjup
Removed Stream! C:\WINNT\KB891781.log:ccccbb
Removed Stream! C:\WINNT\KB893086.log:ercfpp
Removed Stream! C:\WINNT\KB896358.log:nefnxn
Removed Stream! C:\WINNT\KB896358.log:osvtjz
Removed Stream! C:\WINNT\KB896424.log:xcghkn
Removed Stream! C:\WINNT\KB898461.log:pdzmep
Removed Stream! C:\WINNT\KB899589.log:ivjrhz
Removed Stream! C:\WINNT\KB901017.log:awcwbk
Removed Stream! C:\WINNT\KB905414.log:gflecp
Removed Stream! C:\WINNT\KB905495.log:uumqgo
Removed Stream! C:\WINNT\KB908519.log:yyejwa
Removed Stream! C:\WINNT\LUINSTALL.LOG:mnweiz
Removed Stream! C:\WINNT\msdfmap.ini:odykc
Removed Stream! C:\WINNT\ocgen.log:nmrmyr
Removed Stream! C:\WINNT\ODBCINST.INI:fnczst
Removed Stream! C:\WINNT\Q329390.log:trfojs
Removed Stream! C:\WINNT\Q331953.log:msxuec
Removed Stream! C:\WINNT\stub6.ini:fqzfug
Removed Stream! C:\WINNT\tabletoc.log:qskpqt
Removed Stream! C:\WINNT\_default.pif:agdutn
Removed Stream! C:\WINNT\_default.pif:csykpq
Removed Stream! C:\WINNT\_default.pif:fmuion
Removed Stream! C:\WINNT\_default.pif:lzomqi
Removed Stream! C:\WINNT\_default.pif:rcwmo
-------------------------------------------------------------
Removed File! : C:\WINNT\apiaz.exe
Removed File! : C:\WINNT\atlsz32.exe
Removed File! : C:\WINNT\ienk32.exe
Removed File! : C:\WINNT\iewg.exe
Removed File! : C:\WINNT\ipme.exe
Removed File! : C:\WINNT\ipuc32.exe
Removed File! : C:\WINNT\javabr.exe
Removed File! : C:\WINNT\javarb32.exe
Removed File! : C:\WINNT\msth32.exe
Removed File! : C:\WINNT\ntrv.exe
Removed File! : C:\WINNT\sdkek32.exe
Removed File! : C:\WINNT\sysap.exe
Removed File! : C:\WINNT\sysoq32.exe
Removed File! : C:\WINNT\sysxb32.exe
Removed File! : C:\WINNT\ucbhz.dat
Removed File! : C:\WINNT\vgjls.dat
Removed File! : C:\WINNT\System32\apily.exe
Removed File! : C:\WINNT\System32\atlgh.exe
Removed File! : C:\WINNT\System32\d3fz.exe
Removed File! : C:\WINNT\System32\eawse.txt
Removed File! : C:\WINNT\System32\iefb32.exe
Removed File! : C:\WINNT\System32\iekj32.exe
Removed File! : C:\WINNT\System32\javack32.exe
Removed File! : C:\WINNT\System32\netdh.exe
Removed File! : C:\WINNT\System32\netey.exe
Removed File! : C:\WINNT\System32\ntyj32.exe
Removed File! : C:\WINNT\System32\syszd32.exe
Removed File! : C:\WINNT\System32\yejwa.dll
Removed File! : C:\WINNT\warnhp.html
-------------------------------------------------------------
Removed Temp Files
Internet Explorer Settings Reset!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 6:40:44 PM


Does everything look ok?

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:12 PM

Posted 01 February 2006 - 06:28 AM

Hello,

Looks like we are dealing with a new version of intell*.exe here. That is the one that is causing that exclamation point in the taskbar.

I see oleext.dll is also present, which can mean that your wininet.dll is infected.. so we deal with that afterwards.

First I want you to perform next:

* Open hijackthis, click 'config' (bottom right)
Choose the tab 'misc Tools' on top.
Choose 'delete a file on reboot'
In the field, copy and paste next:

C:\WINNT\System32\intell321.exe

Click open.
Hijackthis will tell you that this file will be deleted on next reboot and if you want to reboot now. Click Yes/ok
Your system must reboot now.

After reboot, check and fix next entry in hijackthis:

O4 - HKLM\..\Run: [intell321.exe] C:\WINNT\System32\intell321.exe

Then, Download smitRem and save the file to your desktop.
Doubleclick it and choose install. This will create a new folder on your desktop with the name smitrem.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

REBOOT!!!! Important!!

After reboot, post a new hijackthislog together with the smitrem-log which will be present on your C:\ with the name smitfiles.txt.
Normally that must deal with the oleext.dll and restore wininet.dll if infected.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 Rivercollin

Rivercollin
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 01 February 2006 - 08:31 PM

Ok...I think we've got it. Here's the Hijack log...I'm sorry...but I can't find the "smitfiles.txt" on my C drive. I've done a search and can't seem to find it. I've done every step of the instructions...did I do something wrong by not being able to find that log? does everything look ok?

Logfile of HijackThis v1.99.1
Scan saved at 7:11:51 PM, on 2/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Gateway Utilities\GWInkMonitor.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\My Documents\My Received Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

#6 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:12 PM

Posted 02 February 2006 - 01:16 AM

Hello,

Your hijackthislog looks clean again.
Odd you couldn't find the log from smitrem. Did smitrem actually scan? Did your desktop and icons disappear while scanning?

How are things running now?
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 Rivercollin

Rivercollin
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 02 February 2006 - 06:20 PM

Hi again:

I'm pretty sure the smitrem ran although I guess I don't know for sure comsidering I don't really know what I'm doing. :thumbsup: I think everything is running fine now though either way. THANK YOU a million times over for having the time and patience to help me out of this! I can't say thank you enough. I hope to never have this problem again, now that I've been educated about it the hard way, but it's good to know you're around to help if it ever happens again. Thank you, thank you!!!!!


Collin

#8 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:12 PM

Posted 02 February 2006 - 07:00 PM

Glad I could help. :thumbsup:

To keep this clean in the future, I would suggest the following things:

Install Spywareblaster
SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It blocks the popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.

* Avoid illegal sites, because that's where most malware is present.
* Don't click on links inside popups.
* Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.
* Download free software only from sites you know and trust. Because a lot of free software can bundle other software, including spyware.

Let your antispywarescanner(s) scan frequently and don't forget to update before.

And I do suggest you perform an online virusscan once in a while. (Housecall and/or Bitdefender). Because what one virusscanner can't find another one maybe can.
Also make sure that your virusscanner, the one that is installed on your system is always up to date!

Make sure your windows has the latest updates, so visit asap: http://windowsupdate.microsoft.com/ to update to SP2!

If you are having XP SP2, read here how to configure Security Features for Internet Explorer:
http://www.microsoft.com/technet/security/...xp/iesecxp.mspx

Also visit this Free Online Scanner for PC Health and Safety

More info on how to prevent malware you can also find here (By Tony Klein)
and here: http://wiki.castlecops.com/Malware_Prevent...nt_Re-infection

Happy surfing again! :flowers:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:12 PM

Posted 04 February 2006 - 10:39 AM

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users