Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Trojan-Spy.HTML.smitfraud.c [Resolved]

Started by gidion , Apr 13 2005 11:42 AM

This topic is locked

#1
gidion

Posted 13 April 2005 - 11:42 AM

Member

Member
29 posts

Seems i've picked up this nasty infection. (the one with the blue screen and locked out windows background control).
Trojan-Spy.html.smitfraud.c

Steps before comming here:
I removed the IGuard (fake AV scanner they offered me) from add/remove programs. and deleted any references i could find to:
freepharmacy
freecasino
etc.
also changed my homepage back to normal.
checked cipher rate (128 bits)

i then performed a windows system update.
turnt of system restore.
scanned with norton (found nothing)
I then deleted the WP.bmp file in the C:\ folder but the WP.exe file wont delete.
Everytime i try to stop popuper from the task manager it doesn't seem to go.(update: fixed this problem after unchecking the "hide OS files" option.)
I'm not too sure either but i think when i got infected not long after, my norton antivirus asked for an update. after giving permission i was told my norton trusted sites list was updated (whether this is related or not).
this got me so far as a black desktop but still only 2 option tabs upon desktop properties.
windows yellow triangle in taskbar warning, flashing about 4 exploits (which when clicked leads to adverts)

Results from the what to do section of this site:

Step 1: Adaware initial scan came up with lots i delted. after comming here and installing a new version with updates i only had things like last windows playlist etc to delete so i deleted all of those.

Step 2: CWShredder found CWS.Homesearch which i removed.

Step 3: SpyBot found no immediate threats

Step 4: I run a full system scan with norton instead of AVG(thanks for advice on only having 1 AV scanner, wasnt aware of that). again nothing found.

Step 5: I ran housecall and found nothing

Step 6: ran TDS-3 - no trojan mutexes found

Step 7- performed express windows update.

restarted system (still have black background. 2 tabs on desktop properties setting. popups and triangular warning in taskbar. along with WP.exe still in C:\ and popup.exe still arriving in task manager.
Below is my log file from Hijack This:

Logfile of HijackThis v1.99.1
Scan saved at 18:35:25, on 13/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Brunel University\VPN Client\cvpnd.exe
C:\WINDOWS\runservice.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\helper.exe
C:\WINDOWS\popuper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\WINDOWS\System32\intmonp.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\wp.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\YAHOO!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\winmysqladmin.exe
C:\Program Files\BT Broadband\Help\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\mdm.exe
C:\hijack this\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe acrobat\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {47E3209F-7A75-0AD8-77AF-66E901E684AB} - C:\DOCUME~1\LUKEO'~1\APPLIC~1\SIXTHD~1\2 ace.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - (no file)
O4 - HKLM\..\Run: [SUPASTATUS] C:\Program Files\Internet Explorer\Connection Wizard\STATUS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemHelp] remhelp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [BashRealWebShim] C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\Cash Load.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HOLE SITE] C:\DOCUME~1\LUKEO'~1\APPLIC~1\FACENE~1\Find Exit.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Startup: WinMySQLadmin.lnk = C:\Program Files\MySQL\MySQL Server 4.1\bin\winmysqladmin.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {C7913977-94E3-4288-BB50-35732EA0BE33} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {C7913977-94E3-4288-BB50-35732EA0BE33} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.timesupport.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {11111111-1111-1111-1111-111111111732} - file://c:\progra~1\pl.exe
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...84/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113394165906
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...424/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28A7E44D-0B2D-43DD-9BA0-54637CD93915}: NameServer = 194.74.65.69 194.72.9.34
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Brunel University\VPN Client\cvpnd.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

#2
gidion

Posted 13 April 2005 - 01:43 PM

Member

Topic Starter
Member
29 posts

Going to see what i can deciper from the other posts on this topic and post back here how it goes.
In the mean time if anyone can help it would be much appreciated.
a paypal donation will be winging it's way to my saviour. :tazz:

#3
gidion

Posted 13 April 2005 - 03:10 PM

Member

Topic Starter
Member
29 posts

for the values in the following registry i changed them to 0.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoDispBackgroundPage
NoDispAppearancePage

also changed the wallpaper value from the c:\wp.bmp to my file but still have a black screen (think coz theres other registry references to

it) (one solution on other posts is to place ur desired desktop pic on C drive and name it wp.bmp.)

then I used pocketkiller to remove wp.exe as well as set it to remove again on reboot (just incase).
also set it to remove c:\windows\popupper.exe on reboot

then rebooted into safe mode. checked files were gone (they are).

popupper.exe now nolonger comes up on task manager.

rebooted in normal mode (checked again, again clear)
no ads or popups so far (been back online in normal mode for >15mins now)
so think ive fixed the annoyance side.
still cant edit desktop browse function (still black screen) so still a problem there.

also unaware if theres any stealth things still on my system that are troublesome.
going to do several scans with various tools then will post back results along with logfile.

#4
gidion

Posted 13 April 2005 - 03:14 PM

Member

Topic Starter
Member
29 posts

quick note.
aftet 20 odd minutes. the yellow triangle false expliot alert in task bar popped up.

#5
Ivan Paul

Posted 13 April 2005 - 05:18 PM

New Member

Member
2 posts

Sirs,

I had the same troule;

I got the same condition after remove the wp.exe file and do all recomendations related to wallpaper in this thread; I mean I got again control over the tabs themes, desktop and apearence in display properties windows; but with restrictions in order to browse in desktop tabs.

well, what you have to do in order desktop wallpaper browser work again is: go to regedit, find HKCU->software ->microsoft->windows->policies->

and delete the key system; Voula!! you'll have again all controls in display properties.

#6
gidion

Posted 13 April 2005 - 05:22 PM

Member

Topic Starter
Member
29 posts

could you clarify?
when i goto the policies folder within regedit all i see is

default regsz value not set

#7
gidion

Posted 13 April 2005 - 05:24 PM

Member

Topic Starter
Member
29 posts

do you mean delete the entire folder named "system"
that is within the policies folder?

#8
Ivan Paul

Posted 13 April 2005 - 05:37 PM

New Member

Member
2 posts

Yes, if you dont have any other policies you must remove the system folder.

I have no tried to only remove the entries related to backgroundpage, apearance page, etc that are in system folder, maybe the efect is the same.

but delete the folder named system is sure; i have compared that reg entries with a system not infected and there is no system folder in its registry (at least in that point). I you dont trust you can save that folder with rigth clik export option.

comment your results, .......

#9
gidion

Posted 13 April 2005 - 05:39 PM

Member

Topic Starter
Member
29 posts

thanks ivan.
after my current scan i will do just that.
was going to check my uninfected laptop as you yourself did.
now that youve told me its not a common folder though i shall wipe him clean.
again thanks!

#10
gidion

Posted 13 April 2005 - 05:45 PM

Member

Topic Starter
Member
29 posts

took Ivans advice and the mans a genius :tazz:

my desktop functions are back.

scan results to come for those using this post as help for their own problems

#11
gidion

Posted 13 April 2005 - 06:19 PM

Member

Topic Starter
Member
29 posts

Below are the scan results.
going to manually remove the left over url's etc that panda found then post a hijack this log file before doing yet more scans!! :tazz:

Online Scan
http://security.syma...com/default.asp?

Scanned: 81388
Detected: 0

Real slow scan!

TDS-3
no virus' found

SpyBot
nothing found

Ad-Aware
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:09:50.265
Objects scanned:159835
Objects identified:2
Objects ignored:0
New critical objects:2

Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Windows Object Recognized!
Type : RegData
Data : explorer.exe, msmsgs.exe
Category : Vulnerability
Comment : Shell Possibly Compromised
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows nt\currentversion\winlogon
Value : Shell
Data : explorer.exe, msmsgs.exe

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : luke o'sullivan@cgi-bin[2].txt
Category : Data Miner
Comment : Hits:5
Value : Cookie:luke o'[email protected]/cgi-bin
Expires : 11-04-2015 21:45:16
LastSync : Hits:5
UseCount : 0
Hits : 5

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 15

Online panda scan
I think alot of these may be old traces left by removed spyware. some must be recent though.

Incident Status Location

Adware:Adware/Lop No disinfected C:\DOCUME~1\LUKEO'~1\APPLIC~1\SIXTHD~1\2 ace.exe
Adware:Adware/Lop No disinfected c:\docume~1\lukeo'~1\locals~1\temp\eysxvdwc.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\INTERDRAW.exe
Spyware:Spyware/Zhopa No disinfected C:\WINDOWS\System32\msmsgs.exe
Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/CWS No disinfected C:\Documents and Settings\Luke O'Sullivan\Favorites\Online Gambling\Online Gambling.url
Virus:Trj/Startpage.LH Disinfected Operating system
Adware:Adware/SuperSpider No disinfected C:\Documents and Settings\Luke O'Sullivan\Favorites\online dating.url
Spyware:Spyware/Petro-Line No disinfected C:\Documents and Settings\Luke O'Sullivan\Favorites\Sites about\Ab scissor.url
Adware:Adware/IGuard No disinfected C:\WINDOWS\System32\wldr.dll
Adware:Adware/MediaTickets No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8LQBKX27\main[1].htm
Adware:Adware/MediaTickets No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7IFAKPDK\MediaTicketsInstaller[1].cab[MediaTicketsInstaller.INF]
Adware:Adware/MediaTickets No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7IFAKPDK\MediaTicketsInstaller[1].cab[MediaTicketsInstaller.ocx]
Spyware:Spyware/Zhopa No disinfected C:\WINDOWS\system32\msmsgs.exe
Virus:Trj/Multidropper.UW Disinfected C:\WINDOWS\system32\ole32vbs.exe
Spyware:Spyware/Hyperbar No disinfected C:\WINDOWS\Installer\44b5d.msi[unk_0016][Hyperbar.dll]
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\INTERDRAW.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\deletebold.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\wipe exit.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\math 1.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\Cash Load.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Local Settings\Temp\eysxvdwc.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\ejuejuir.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\LiesOnceHeart.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\qrrousrs.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\nsvlrzfb.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\sktfsbol.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\hmcsypxf.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\Find Exit.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\FACENEWBEEP\fcjzouzn.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Luke O'Sullivan\Application Data\SixthDoesHope\2

Edited by gidion, 13 April 2005 - 06:19 PM.

#12
-JuSTiN-

Posted 13 April 2005 - 06:51 PM

Member

Member
24 posts

i just got the same trojan today. I don't have a AntiVirus and I can't get anything like internet explorer too open. I was able to get regedit to open but nothing else using the Task Manager. I don't know what to do. I deleted that system folder in the regedit and the blue screen is still there. Can anyone please help?

#13
gidion

Posted 13 April 2005 - 06:53 PM

Member

Topic Starter
Member
29 posts

used pocket killer to remove all those files from pander.

just got the yellow triangle popup in taskbar again :tazz:

more scans for me then

#14
gidion

Posted 13 April 2005 - 06:55 PM

Member

Topic Starter
Member
29 posts

justin
if you have removed system from registry then right click on desktop and reset your desktop background.
other than that id say read through the posts and (things to do before you start which is on this site) and see what the free scanners pick up for u.

#15
gidion

Posted 13 April 2005 - 06:56 PM

Member

Topic Starter
Member
29 posts

Most recent Hijack this logfile incase anyone out there see's the obvious problem.

Logfile of HijackThis v1.99.1
Scan saved at 01:52:22, on 14/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Brunel University\VPN Client\cvpnd.exe
C:\WINDOWS\runservice.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\helper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijack this\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe acrobat\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {47E3209F-7A75-0AD8-77AF-66E901E684AB} - C:\DOCUME~1\LUKEO'~1\APPLIC~1\SIXTHD~1\2 ace.exe (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Messenger\ycomp.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - (no file)
O4 - HKLM\..\Run: [SUPASTATUS] C:\Program Files\Internet Explorer\Connection Wizard\STATUS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemHelp] remhelp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [BashRealWebShim] C:\Documents and Settings\All Users\Application Data\Memo Dash Bash Real\Cash Load.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HOLE SITE] C:\DOCUME~1\LUKEO'~1\APPLIC~1\FACENE~1\Find Exit.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Startup: WinMySQLadmin.lnk = C:\Program Files\MySQL\MySQL Server 4.1\bin\winmysqladmin.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {C7913977-94E3-4288-BB50-35732EA0BE33} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {C7913977-94E3-4288-BB50-35732EA0BE33} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.timesupport.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {11111111-1111-1111-1111-111111111732} - file://c:\progra~1\pl.exe
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...84/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113394165906
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...424/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28A7E44D-0B2D-43DD-9BA0-54637CD93915}: NameServer = 194.74.65.69 194.72.9.34
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Brunel University\VPN Client\cvpnd.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe