They're back! Please help. [RESOLVED]

Welcome Guest ( Log In | Join )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide. Want to reply to a topic, start a new one, or remove the advertising? Join today (always free).

> Geeks to Go! » Security » Malware Removal - HijackThis™ Logs Go Here

2 Pages

1 2 >

They're back! Please help. [RESOLVED], More unknown viruses on work computer.

Options

emocoregirl View Member Profile	Aug 23 2005, 10:09 AM Post #1
Member Posts: 26 From: New Jersey OS: windows xp	I had the aurora, nail, winfixer problem just a few weeks ago. it was all cleared up and my computer has been working very well ever since. Just yesterday I had received some virus notifications, although, i can't seem to find the viruses and my computer does not have many (if any at all, throughout the day) pop-ups. any help would be so greatly appreciated. Here is my HJT log: Logfile of HijackThis v1.99.1 Scan saved at 12:08:25 PM, on 08/23/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NavNT\defwatch.exe C:\cleanup programs\security suite\ewidoctrl.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\SKDAEMON.EXE C:\WINDOWS\system32\ICO.EXE C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\NavNT\vptray.exe C:\WINDOWS\system32\Pelmiced.exe C:\Program Files\Microsoft Office\Office\1033\msoffice.exe F:\WordPerfect Office 2000\programs\dad9.exe C:\WINDOWS\System32\SKSMAILD.EXE C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\HJT-log\HijackThis.exe C:\Program Files\Microsoft Office\Office\EXCEL.EXE C:\Program Files\Internet Explorer\iexplore.exe O4 - HKLM\..\Run: [Hot Key Kbd Daemon] SKDAEMON.EXE O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - Startup: Desktop Application Director 9.LNK = WordPerfect Office 2000\programs\dad9.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O4 - Global Startup: Service Manager.norun O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = NLFISHCO.COM O17 - HKLM\Software\..\Telephony: DomainName = NLFISHCO.COM O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = NLFISHCO.COM O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: ewido security suite control - ewido networks - C:\cleanup programs\security suite\ewidoctrl.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe This post has been edited by emocoregirl: Aug 23 2005, 10:11 AM

tampabelle View Member Profile	Aug 23 2005, 07:21 PM Post #2
Member 5k Posts: 6,363 OS: Windows XP	Hi emocogirl, Your HJT log looks fine. Can you tell me which program gives you the virus notification ?? Also can you post the logs from that program ??

emocoregirl View Member Profile	Aug 24 2005, 07:09 AM Post #3
Member Posts: 26 From: New Jersey OS: windows xp	the programs that give me the notifications would be Norton and also Ewido does come up with some after a scan. my processes running show 32 and there are 1 or 2 that don't look at all familiar to me. i will post a log of these and the logs of viruses shortly. sorry, i'm at work.

emocoregirl View Member Profile	Aug 24 2005, 07:45 AM Post #4
Member Posts: 26 From: New Jersey OS: windows xp	Actually, looking at it now, You're right! it does look fine. although, once i'm about to do a back up on the server, it always tells me that my computer has a virus, sometimes two. sometimes Norton will pop a notice up saying i have one when i'm at my computer, sometimes it won't. Ewido, i use everyday just to be sure since i am getting these notifications...usually it will find at least one virus a day. I'm not sure where they'd be coming from tho. No pop ups...no problems at all lately. Logfile of HijackThis v1.99.1 Scan saved at 9:35:26 AM, on 08/24/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NavNT\defwatch.exe C:\cleanup programs\security suite\ewidoctrl.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\SKDAEMON.EXE C:\WINDOWS\system32\ICO.EXE C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\Microsoft Office\Office\1033\msoffice.exe C:\WINDOWS\system32\Pelmiced.exe F:\WordPerfect Office 2000\programs\dad9.exe C:\WINDOWS\System32\SKSMAILD.EXE C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\cleanup programs\security suite\SecuritySuite.exe C:\HJT-log\HijackThis.exe O4 - HKLM\..\Run: [Hot Key Kbd Daemon] SKDAEMON.EXE O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - Startup: Desktop Application Director 9.LNK = WordPerfect Office 2000\programs\dad9.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O4 - Global Startup: Service Manager.norun O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = NLFISHCO.COM O17 - HKLM\Software\..\Telephony: DomainName = NLFISHCO.COM O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = NLFISHCO.COM O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: ewido security suite control - ewido networks - C:\cleanup programs\security suite\ewidoctrl.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe so far these are my logs from Ewido: 8/22/05 --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 1:14:48 PM, 08/22/2005 + Report-Checksum: DE93FBDA + Scan result: C:\WINDOWS\system32\drivers\df_kmd.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup C:\WINDOWS\system32\VVSNInst.exe -> Adware.SaveNow : Cleaned with backup ::Report End 8/23/05 --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 11:55:57 AM, 08/23/2005 + Report-Checksum: AFE10458 + Scan result: C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup ::Report End the scan from today is still running, but almost finished and hasn't found any yet. sorry for any inconvenience if this computer really is free of any infections. but it's better safe than sorry. heh Thanks!!!

emocoregirl View Member Profile	Aug 24 2005, 10:40 AM Post #5
Member Posts: 26 From: New Jersey OS: windows xp	i just got another norton notification telling me that it found a virus. I'm going to do a print screen and put an attachement with this reply to show you what it is coming up with. quite alot there. thanks.

tampabelle View Member Profile	Aug 24 2005, 11:18 AM Post #6
Member 5k Posts: 6,363 OS: Windows XP	Can you post the scan report ??? that will be better

emocoregirl View Member Profile	Aug 25 2005, 10:03 AM Post #7
Member Posts: 26 From: New Jersey OS: windows xp	This is really the best i can do. for some reason, once norton is done scanning it will show that it found 0 viruses, but there are tons in the history window, which i attached last night. --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 12:01:42 PM, 08/25/2005 + Report-Checksum: 172B7BD4 + Scan result: C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@ads.addynamix[1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@citi.bridgetrack[1].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup C:\Documents and Settings\jill.NLFISHCO\Cookies\jill@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup ::Report End

tampabelle View Member Profile	Aug 25 2005, 10:09 AM Post #8
Member 5k Posts: 6,363 OS: Windows XP	Delete the files - C:\WINDOWS\system32\drivers\df_kmd.sys C:\WINDOWS\system32\VVSNInst.exe Please download RootKitRevealer from here: http://www.sysinternals.com/files/rootkitrevealer.zip Unzip it to the desktop, run it, and click Scan. This will generate a log file; please post the entire contents of the log file here for me to see.

tampabelle View Member Profile	Aug 25 2005, 12:31 PM Post #10
Member 5k Posts: 6,363 OS: Windows XP