Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Start Page Hijacked With Http://www.bestsecurityguide.com/


  • This topic is locked This topic is locked
21 replies to this topic

#1 judy7

judy7

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 09 April 2006 - 01:21 PM

Here is my Hijack this log.
I so appreciate your help. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 2:14:16 PM, on 4/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\nvctrl.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: Nothing - {7a932ed2-1737-4ab8-b84d-c71779958551} - C:\WINDOWS\system32\hp503E.tmp
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nup] C:\WINDOWS\nup.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://msltv.multicastmedia.com/common/mbr...MINIBrowser.CAB
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

BC AdBot (Login to Remove)

 


m

#2 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 09 April 2006 - 04:47 PM

Hello and Welcome :thumbsup:

Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

===================================

Please download the trial version of Ewido Anti-malware 3.5 .
  • Install Ewido anti-malware.
  • When installing, under Additional Options uncheck Install background guard and Install scan via context menu.
  • When you run Ewido for the first time, you could get a warning "Database could not be found!". Click Ok.
  • The program will prompt you to update. Click the Ok button.
  • The program will now go to the main screen.
You will need to update Ewido to the latest definition files.
  • On the left-hand side of the main screen click the Update Button.
  • Click on Start.
The update will start and a progress bar will show the updates being installed.
Once finished updating, close Ewido. We will use it later.

If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates. Make sure to close Ewido before installing the update.

===================================

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with a fresh HijackThis log in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!

#3 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 09 April 2006 - 05:41 PM

Thank you.
Here are the logs.

SmitFraudFix v2.29

Scan done at 18:35:25.81, Sun 04/09/2006
Run from C:\unzipped\SmitfraudFix[1]\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]

C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32

C:\WINDOWS\system32\amcompat.tlb FOUND !
C:\WINDOWS\system32\dfrgsrv.exe FOUND !
C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\interf.tlb FOUND !
C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\mssearchnet.exe FOUND !
C:\WINDOWS\system32\ncompat.tlb FOUND !
C:\WINDOWS\system32\nscompat.tlb FOUND !
C:\WINDOWS\system32\nvctrl.exe FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\1024\ FOUND !

C:\Documents and Settings\Judy\Application Data


Start Menu


C:\Documents and Settings\Judy\Favorites

C:\Documents and Settings\Judy\Favorites\Antivirus Test Online.url FOUND !

Desktop


C:\Program Files

C:\Program Files\Security Toolbar\ FOUND !

Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


Sharedtaskscheduler

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"

[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"


Scanning wininet.dll infection


End

Logfile of HijackThis v1.99.1
Scan saved at 6:40:49 PM, on 4/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\nvctrl.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\Notepad.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: Nothing - {7a932ed2-1737-4ab8-b84d-c71779958551} - C:\WINDOWS\system32\hp503E.tmp
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nup] C:\WINDOWS\nup.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://msltv.multicastmedia.com/common/mbr...MINIBrowser.CAB
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Oh and did I say THANKS!!

#4 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 09 April 2006 - 05:49 PM

Oh and did I say THANKS!!


You're welcome but don't worry. There is still work to do. :thumbsup:

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. You can even print it if you like. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
===================================

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if your computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

===================================

Clean out your Temporary Internet files. Proceed like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

===================================

Close ALL open Windows / Programs / Folders. Please start Ewido, and run a full scan.
  • Click on Scanner
  • Click on Settings
    • Under How to scan all boxes should be checked
    • Under Unwanted Software all boxes should be checked
    • Under What to scan select Scan every file
    • Click on Ok
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.
  • Click Save Report button
  • Save the report to your Desktop
Close Ewido and Reboot in Normal Mode.

===================================

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter.
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

===================================

Please post:
  • c:\rapport.txt
  • Ewido log
  • A new HijackThis log
You may need several replies to post the requested logs, otherwise they might get cut off.

#5 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 09 April 2006 - 07:29 PM

Here are the scans and logs. My computer appears to be running VERY SLOW now. ??

SmitFraudFix v2.29

Scan done at 18:59:21.57, Sun 04/09/2006
Run from C:\Documents and Settings\Judy\Desktop\Smitfraud
OS: Microsoft Windows XP [Version 5.1.2600]

Killing process


Deleting infected files

C:\WINDOWS\system32\amcompat.tlb Deleted
C:\WINDOWS\system32\dfrgsrv.exe Deleted
C:\WINDOWS\system32\hp????.tmp Deleted
C:\WINDOWS\system32\interf.tlb Deleted
C:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\mssearchnet.exe Deleted
C:\WINDOWS\system32\ncompat.tlb Deleted
C:\WINDOWS\system32\nscompat.tlb Deleted
C:\WINDOWS\system32\nvctrl.exe Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\WINDOWS\system32\1024\ Deleted
C:\Documents and Settings\Judy\Favorites\Antivirus Test Online.url Deleted
C:\Program Files\Security Toolbar\ Deleted

Deleting Temp Files


Registry Cleaning

Registry Cleaning done.

End

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 8:08:57 PM, 4/9/2006
+ Report-Checksum: DB6C667D

+ Scan result:

HKU\S-1-5-21-1078081533-1592454029-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@com[2].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@cz3.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@data1.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@e-2dj6wfmikpdjidq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@e-2dj6wgkiegdjsbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@ehg-darksideprod.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@giftscom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@hypertracker[2].txt -> TrackingCookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@image.masterstats[2].txt -> TrackingCookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@programs.wegcash[2].txt -> TrackingCookie.Wegcash : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@server3.web-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@webstat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@www.abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@www.web-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlikhd5wgoqwdj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlispdjaeqamdj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyelcjcfqq2dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyooc5slqaqdj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup
C:\Documents and Settings\Patrick\Cookies\patrick@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Downloads\MonopolyJR-dm[1].exe -> Adware.Trymedia : Cleaned with backup
C:\Program Files\MonopolyJR-dm.exe -> Adware.Trymedia : Cleaned with backup
C:\RECYCLER\NPROTECT\00038332.TXT -> TrackingCookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/Save.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/Save.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/Sync.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/Uninst.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/Sync.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039805/Uninst.exe -> Adware.SaveNow : Cleaned with backup
C:\RECYCLER\NPROTECT\00039824 -> Adware.VirtualBouncer : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\WUInst.dll -> Adware.SaveNow : Cleaned with backup
C:\WINDOWS\system32\ldb.dll -> Adware.PurityScan : Cleaned with backup
C:\WINDOWS\system32\Таsks\rundll.exe -> Adware.MediaTickets : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 8:16:02 PM, on 4/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\HiJack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: (no name) - {7a932ed2-1737-4ab8-b84d-c71779958551} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nup] C:\WINDOWS\nup.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://msltv.multicastmedia.com/common/mbr...MINIBrowser.CAB
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

#6 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 09 April 2006 - 08:20 PM

You are doing very well. It's looking much better. Let's continue.

We'll need to disable the real time scanners so that they will not interfere with the fixes.

MS AntiSpyware (MSAS) Beta
1. Right-click on the Microsoft Anti-Spyware icon in the system tray [it's the one with the red and yellow bulls-eye].
2. Click on "Security Agents Status".
3. Click on "Disable real-time protection".

Next right-click on the Microsoft Anti-Spyware icon in the system tray again to open Microsoft Anti-Spyware.
1. Click on the Options menu and choose Settings.
2. In the left pane column click on "Real Time Protection".
3. Under Startup Options, uncheck "Enable (MSAS) Security Agents on startup (recommended)"
4. Under Real-time spyware threat protection, uncheck and "Enable real-time spyware threat protection" (recommended).
5. Click the Save button and close Microsoft AntiSpyware.
Finally, right-click on the MSAS icon in the system tray and select "Shutdown Microsoft Antispyware".

Spybot S&D (Teatimer)
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.

=======================================
  • Close all open Explorer windows and browsers/email, etc
  • Run HijackThis
  • Click on the Scan button and when complete
  • Put a check beside all of the items listed below
  • Click on the "Fix Checked" button
  • When completed, close the application.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: (no name) - {7a932ed2-1737-4ab8-b84d-c71779958551} - (no file)
O2 - BHO: (no name) - {7a932ed2-1737-4ab8-b84d-c71779958551} - (no file)
O4 - HKLM\..\Run: [nup] C:\WINDOWS\nup.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe


The following activeX controls( Download Program Files)will reinstall when(and if) you revisit that website,
UNLESS you know they are from a safe source, check to remove.

O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://msltv.multicastmedia.com/common/mbr...MINIBrowser.CAB

=======================================

Your Java is out of date....
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.
  • Close any programmes you may have running, ESPECIALLY your web browser
  • Click Start > Control Panel.
  • Click Add/Remove Programs.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove all versions of Java.
  • Reboot your computer once all Java components are removed.
Then download the latest version of Java Runtime Environment, and install it to your computer.

=======================================

Please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.

=======================================

Please post back a fresh HijackThis log and the Kaspersky online scan results, please.

Edited by amateur, 09 April 2006 - 08:28 PM.


#7 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 09 April 2006 - 10:16 PM

Sunday, April 09, 2006 11:10:44 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 10/04/2006
Kaspersky Anti-Virus database records: 187165


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 68081
Number of viruses found 19
Number of infected objects 50
Number of suspicious objects 0
Duration of the scan process 01:15:56

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0D880000.VBN/ds-rwe.exe Infected: Email-Worm.Win32.Bagle.br skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0D880000.VBN ZIP: infected - 1 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0D880000.VBN CryptZ: infected - 1 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0D880002.VBN Infected: Email-Worm.Win32.Bagle.br skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F040000.VBN/[From joe ][Date Invalid date header replaced by ms-mta-02.nyroc.rr.com; original]/jennifer Infected: Email-Worm.Win32.Zafi.b skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F040000.VBN Mail: infected - 1 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F040000.VBN CryptZ: infected - 1 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F040002.VBN/[From joe ][Date Invalid date header replaced by ms-mta-02.nyroc.rr.com; original]/jennifer Infected: Email-Worm.Win32.Zafi.b skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F040002.VBN Mail: infected - 1 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F040002.VBN CryptZ: infected - 1 skipped

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.q skipped

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0005 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0007 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0008 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0009 Infected: Trojan.Win32.Qhost.ap skipped

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe NSIS: infected - 5 skipped

C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.q skipped

C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0005 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0007 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0008 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0009 Infected: Trojan.Win32.Qhost.ap skipped

C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe NSIS: infected - 5 skipped

C:\Documents and Settings\Patrick\Local Settings\Temp\wups.exe Infected: Trojan-Dropper.Win32.PurityScan.ac skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\3IS7N5CL\586[1].htm Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip/Setup.exe Infected: not-a-virus:AdWare.Win32.IEDriver.b skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip/Files/3.exe Infected: not-a-virus:AdWare.Win32.IEDriver.b skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip/Files/5.exe Infected: not-a-virus:AdWare.Win32.IEDriver.b skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip/Files/IEDRIVER.EXE Infected: Trojan-Downloader.Win32.Turown.h skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip/Files/ieupdate.exe Infected: Trojan-Downloader.Win32.Turown.b skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip/Files/td.exe Infected: Trojan-Downloader.Win32.Turown.a skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002/data299033.zip Infected: Trojan-Downloader.Win32.Turown.a skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0002 Infected: Trojan-Downloader.Win32.Turown.a skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0003/data0003 Infected: not-a-virus:AdWare.Win32.Connector skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0003/data0004 Infected: not-a-virus:AdWare.Win32.Connector skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0003 Infected: not-a-virus:AdWare.Win32.Connector skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0004 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005/data0001.cab/Save.exe Infected: not-a-virus:AdWare.Win32.SaveNow.t skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005/data0001.cab/SaveUninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.af skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.af skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005/data0002.cab/Sync.exe Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005/data0002.cab/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005/data0002.cab Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0005 Infected: not-a-virus:AdWare.Win32.SaveNow.v skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0006 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe/data0007 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\81YRODUV\all_files4[1].exe NSIS: infected - 21 skipped

C:\HiJack This\backups\backup-20060409-055942-889.dll Infected: Trojan-Downloader.Win32.Zlob.ku skipped

C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j skipped

C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe WiseSFX: infected - 1 skipped

C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe WiseSFX Dropper: infected - 1 skipped

Scan process completed.



And the Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 11:12:15 PM, on 4/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MR Tech Systray\mrsystray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HiJack This\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: MR Tech Systray.lnk = C:\Program Files\MR Tech Systray\mrsystray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

#8 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 10 April 2006 - 05:44 AM

Hi Judy 7,

Thanks for the logs. Give me some time to go through them and come back with the next set of instructions. We are getting close to a clean computer now.

Edited by amateur, 10 April 2006 - 06:20 AM.


#9 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 10 April 2006 - 07:12 AM

Thanks - I'll check in after work today.

#10 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 10 April 2006 - 07:15 AM

Hi Judy7,

You are following the instructions very nicely. Thank you. The log from HijackThis is clean, but it doesn't show everything. We need to clean the rest now. Let's continue.

This is only precautionary. You don't have any signs of "purityscan" in the HijackThis log, but you have a lot of signs of it in the Kaspersky report. So, let's do this to make sure that it's removed completely.

Press Ctrl-Alt-Del once to bring up the End Task dialogue. Highlight "WINSERVS" or "WINSERVN" and select End Task. (It may take a few moments for a "not responding" warning to appear. Press End Task again.) Do the same for any occurrence of "WINSERVN", if they exist.

Clickspring provides the following uninstaller to remove PurityScan: http://www.purityscan.com/ps_uninstaller.exe
or
http://www.purityscan.com/uninstall.html

Run the Uninstaller per instructions. Answer any questions carefully.

======================================

Make sure that you can see hidden files
" Click Start
" Open My Computer
" Select the Tools menu and click Folder Options
" Select the View Tab
" Under the Hidden files and folders heading select Show hidden files and folders
" Uncheck the Hide protected operating system files (recommended) option
" Click Yes to confirm
" Click OK

We'll reset them once we are finished.

======================================

Remove the items stored in the Norton Quarantine.

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine

If you don't know how to do that, you can read it here

======================================

Download Pocket Killbox and install it to your Desktop. Do not run it yet.

======================================

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

======================================

Double-click killbox.exe

Click Tools > Delete Temp Files.

Click the drop down menu in the middle and select C:\Documents and Settings\Patrick from the list.

Now check/tick the boxes beside the following options above the drop down menu:

[x] Temporary Internet Files
[x] Temp Files
[x] Cookies
[x] XP Prefetch
[x] Recent
[x] History

Then click the Delete Selected Temp Files button.

Back on the main Killbox menu now, select the option "Delete on reboot" and then click the Process all on list button.
  • First copy the filepaths in the box below to your clipboard, by highlighting them and pressing Ctrl+C.

C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0003
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0005
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0007
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0008
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0009
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe NSIS
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0003
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0005
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0007
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0008
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0009
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe NSIS
C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe
C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe/WISE0001.BIN
C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe WiseSFX
C:\WINDOWS\Downloaded Program Files\BundleOuter1129031120(3).exe WiseSFX Dropper

  • Open Killbox and check a mark in the "RadioBox" which says Delete On Reboot
  • Click File > Paste from Clipboard.
  • Click on the Red button with a Cross, and answer Yes when prompted to Backup and Delete the pasted files.
  • Answer Yes when prompted to Reboot in Normal Mode now.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

======================================

Tell me what else is in these folders: If you don't have anything that you would like to keep, you can delete the first "data" folder which would delete the second one too.

C:\Documents and Settings\Default User\My Documents\Data\Data
C:\Documents and Settings\Default User\My Documents\Data

======================================

Please run Ewido, this time in Normal Mode, again

======================================

Run Kaspersky again.

======================================

Post the new logs from Ewido and Kaspersky.

Edited by amateur, 10 April 2006 - 01:06 PM.


#11 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 10 April 2006 - 08:55 PM

Here's the latest scans. Thank you.
------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 9:53:38 PM, 4/10/2006
+ Report-Checksum: 9AF9634C

+ Scan result:

C:\Documents and Settings\Judy\Cookies\judy@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Judy\Cookies\judy@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Judy\Cookies\judy@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned with backup
C:\Documents and Settings\Judy\Cookies\judy@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\Judy\Cookies\judy@sel.as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\Judy\Cookies\judy@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup


::Report End

Monday, April 10, 2006 7:05:43 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 10/04/2006
Kaspersky Anti-Virus database records: 187408


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 66963
Number of viruses found 10
Number of infected objects 28
Number of suspicious objects 0
Duration of the scan process 01:22:46

Infected Object Name Virus Name Last Action
C:\!KillBox\all_files4.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.q skipped

C:\!KillBox\all_files4.exe/data0005 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\!KillBox\all_files4.exe/data0007 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\!KillBox\all_files4.exe/data0008 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\!KillBox\all_files4.exe/data0009 Infected: Trojan.Win32.Qhost.ap skipped

C:\!KillBox\all_files4.exe NSIS: infected - 5 skipped

C:\!KillBox\all_files4.exe( 1)/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.q skipped

C:\!KillBox\all_files4.exe( 1)/data0005 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\!KillBox\all_files4.exe( 1)/data0007 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\!KillBox\all_files4.exe( 1)/data0008 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\!KillBox\all_files4.exe( 1)/data0009 Infected: Trojan.Win32.Qhost.ap skipped

C:\!KillBox\all_files4.exe( 1) NSIS: infected - 5 skipped

C:\!KillBox\BundleOuter1129031120(3).exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j skipped

C:\!KillBox\BundleOuter1129031120(3).exe WiseSFX: infected - 1 skipped

C:\!KillBox\BundleOuter1129031120(3).exe WiseSFX Dropper: infected - 1 skipped

C:\Documents and Settings\Judy\Local Settings\Temporary Internet Files\Content.IE5\C1WTQ7GT\ps_uninstaller[1].exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped

C:\Documents and Settings\Judy\Local Settings\Temporary Internet Files\Content.IE5\C1WTQ7GT\ps_uninstaller[1].exe NSIS: infected - 1 skipped

C:\HiJack This\backups\backup-20060409-055942-889.dll Infected: Trojan-Downloader.Win32.Zlob.ku skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1.VBN/[From joe ][Date Invalid date header replaced by ms-mta-02.nyroc.rr.com; original]/jennifer Infected: Email-Worm.Win32.Zafi.b skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1.VBN Mail: infected - 1 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1.VBN CryptZ: infected - 1 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc2.VBN/ds-rwe.exe Infected: Email-Worm.Win32.Bagle.br skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc2.VBN ZIP: infected - 1 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc2.VBN CryptZ: infected - 1 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc3.VBN Infected: Email-Worm.Win32.Bagle.br skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc4.VBN/[From joe ][Date Invalid date header replaced by ms-mta-02.nyroc.rr.com; original]/jennifer Infected: Email-Worm.Win32.Zafi.b skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc4.VBN Mail: infected - 1 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc4.VBN CryptZ: infected - 1 skipped

Scan process completed.

#12 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 10 April 2006 - 09:31 PM

OK. We are getting close. Ewido is showing some cookies only which is normal. You would get them whenever you visit a web site. There are still some infected items showing up in Kaspersky.

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

==============================

We had already set Windows to show all files. If you've reversed it, we need to do it again:

Make sure that you can see hidden files
" Click Start
" Open My Computer
" Select the Tools menu and click Folder Options
" Select the View Tab
" Under the Hidden files and folders heading select Show hidden files and folders
" Uncheck the Hide protected operating system files (recommended) option
" Click Yes to confirm
" Click OK

==============================

Using Windows Explorer (right click on Start, click on Explore), navigate and delete the following files and folders:

You can go to C:\!KillBox\
C:\Documents and Settings\Judy\Local Settings\Temporary Internet Files\Content.IE5\

C:\HiJack This\backups\backup-20060409-055942-889.dll

==============================

Go to Start > Run and type: CLEANMGR.EXE and hit enter.
When prompted select the C: drive and click ok.
Check the boxes for " Temporary Internet Files
" Downloaded Program Files
" Recycle Bin
" Temporary Files
:
Click OK or Enter

===============================
Scan one more time with Kaspersky and post back the results. Hopefully it will be the last time.

#13 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 11 April 2006 - 06:19 PM

Thanks for staying with me on this!

From your last reply:

Using Windows Explorer (right click on Start, click on Explore), navigate and delete the following files and folders:

You can go to C:\!KillBox\ DONE
C:\Documents and Settings\Judy\Local Settings\Temporary Internet Files\Content.IE5\ COULD NOT FIND FILE

C:\HiJack This\backups\backup-20060409-055942-889.dll DONE

Kaspersky scan:

Tuesday, April 11, 2006 7:14:42 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 11/04/2006
Kaspersky Anti-Virus database records: 187653


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 65729
Number of viruses found 6
Number of infected objects 15
Number of suspicious objects 0
Duration of the scan process 01:02:49

Infected Object Name Virus Name Last Action
C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.q skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe/data0005 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe/data0007 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe/data0008 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe/data0009 Infected: Trojan.Win32.Qhost.ap skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe NSIS: infected - 5 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe( 1)/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.q skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe( 1)/data0005 Infected: Trojan-Downloader.Win32.Agent.ec skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe( 1)/data0007 Infected: not-a-virus:AdWare.Win32.EZula skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe( 1)/data0008 Infected: Trojan-Downloader.Win32.Apropo.v skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe( 1)/data0009 Infected: Trojan.Win32.Qhost.ap skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\all_files4.exe( 1) NSIS: infected - 5 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\BundleOuter1129031120(3).exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.VirtualBouncer.j skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\BundleOuter1129031120(3).exe WiseSFX: infected - 1 skipped

C:\RECYCLER\S-1-5-21-1078081533-1592454029-682003330-1004\Dc1\BundleOuter1129031120(3).exe WiseSFX Dropper: infected - 1 skipped

Scan process completed.


I ran this scan in normal, not Safe mode.

#14 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:36 AM

Posted 11 April 2006 - 07:06 PM

Hello Judy7

You are doing an excellent job. :thumbsup:
Scan results show some infected files in the Recycle Bin. This is a little odd because the CLEANMGR.EXE should have taken care of that. Do you have that Norton protected Recycle Bin which, in my opinion, is only good for keeping stuff you don't need? You'll need to empty that.

You can now delete the Killbox from your desktop. It also may have a backup file with the infected files. Then, please navigate to C:\!Killbox folder and delete it, if there. Do this before you empty the Norton Protected Recycle Bin so that they won''t show there again next time.

Please empty the Norton Protected Recycle Bin and run Kaspersky again because I want to make sure that those infected files are gone. Please post the results. Once we are sure they are gone, we'll have a few more task to secure the computer. So, I'll be waiting for the results.

#15 judy7

judy7
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:36 AM

Posted 11 April 2006 - 09:21 PM

I followed your instructions thenran Kaspersky scan and it said no items found at this time. It didn't give a report.

Should I go to c:documents and settings/Judy/local settings/temporary internet files and delete all files?

Thanks.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users