Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

vbouncer attack

Started by megapax , Feb 23 2005 06:03 PM

  • This topic is locked This topic is locked

#1
megapax
Posted 23 February 2005 - 06:03 PM

megapax

    Member

  • Member
  • PipPip
  • 12 posts
A couple weeks ago my computer was hit with Vitual Bouncer which relsulted in tons of stuff loading on. I had out of date virus protection and no adware protection. I since have put on Ad-Aware and Zone Alarm, but there are many files remaining including some nasty viruses and malware. I have downloaded your recommended products to do combat, which I will do when I log off the net. I previously downloaded HJT and will give you my initial log. I will update this after I run the recommended programs. Thank you in advance for any assistance. My computer refused to shut down before, so I am hoping that I will be able to get back to this site.


Logfile of HijackThis v1.98.2
Scan saved at 3:03:45 PM, on 2/23/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINNT\System32\PSSVC.EXE
C:\PROGRA~1\NavNT\DefWatch.exe
C:\DMI\bin\dmisrv.exe
C:\DMI\bin\delldmi.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\NavNT\Rtvscan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\DMI\bin\win32sl.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\DMI\bin\nic.exe
C:\DMI\bin\coo.exe
C:\DMI\bin\dnar.exe
C:\DMI\bin\nodemngr.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\qttask.exe
C:\Program Files\Kill Popup\KillPopup.exe
C:\PROGRA~1\NavNT\vptray.exe
C:\WINNT\system32\LXSUPMON.EXE
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Uavrs\Wjoej.exe
C:\Program Files\hpdll\hpdll.exe
C:\Program Files\hpdll\tempdl\RAS012505.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\winnt\system32\msnavc32.exe
C:\Program Files\nls3vbri\nls3vbri.exe
C:\WINNT\isrvs\desktop.exe
C:\WINNT\system32\ntlorts.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\nottsnmp.exe
C:\WINNT\system32\sysmonnt.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Verizon Online\bin\mpbtn.exe
C:\unzipped\hijackthis\HijackThis.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.popupsear...sidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINNT\ZServ.dll
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINNT\BTGrab.dll
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: (no name) - {017C20C1-F86F-11D8-9B25-000ACD002AE3} - C:\WINNT\Helper101.dll
O2 - BHO: (no name) - {0722C99F-CC31-4155-ACFE-85629F52E60D} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {0C62E32B-45D9-43B5-9667-CBB9E004DC51} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {0EA6F4C4-6E9F-4F4F-9B0A-F3DBCE77B8E5} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {1730630D-0717-4BB6-8ECE-58F8E06DF977} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {1A4B7260-740D-43EB-9F84-A387C03708A4} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {242B2746-E3AA-4E75-B7F8-EC240CC2DF47} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {2639417F-24A9-46AE-868C-EA53103E6D84} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {284A165F-C8A8-46F6-A570-F89095F19060} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {28FE6AF4-8070-4A0E-891B-4663154436BD} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {43D64023-2E94-437A-9CE7-3F3C7B5C2116} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {4586B8A1-23D6-4315-AD29-3CB6C63B52E3} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {49F9D152-210A-45EB-8378-F65B5FA3EE8B} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {4A310699-038E-402D-97D9-B0C0468FEE3A} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {521527DB-E565-4DFB-867D-A8B03859FA42} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {530B4F4D-CB8E-4BA1-BFCA-7D26725A99EB} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {53EA209B-A215-4DE7-8BEF-BBAF7438EF1E} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {5A384B18-1267-41EA-B542-6BCAD0F035DD} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINNT\isrvs\sysupd.dll
O2 - BHO: (no name) - {5B888D5C-1E20-46EA-AE47-4FB2F85CE2B9} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {5EA34304-85FF-4361-84AA-4976F096F453} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {6CB357E5-7ED3-4636-A34C-6D2DE5CB25F9} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: IEEvtCatcherObj Class - {7011471D-3F74-498E-88E1-C0491200312D} - C:\PROGRA~1\COMMON~1\Media\OTGlove.dll (file missing)
O2 - BHO: (no name) - {73C3F6DE-6E1F-4CD0-9307-8545E1C0F935} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {7451E86E-20EA-4341-8024-C19AFE873E0C} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {77E0F405-30FD-40AC-9E30-FF9977BBBAD7} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {7974E862-CF34-4857-8C2B-ADC8B67F0C50} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: SDWin32 Class - {8C645624-ED6D-44AB-8922-A0108CBE409F} - C:\WINNT\system32\dkvoi.dll
O2 - BHO: (no name) - {8EEE81E3-FE45-4D0F-94CC-DDB12E85E017} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {941EC85D-78AF-421C-931A-0C84902E878C} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {A1360057-5EBA-4606-9034-5F8CFEEE0240} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {A25D8FE3-25B3-4C63-A2F1-D74915DF8361} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {A9B06050-9E51-4738-A805-224F18D8DD51} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {AA256EB9-5BE9-47A1-BE78-40E4D7F08D4C} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {AA562628-5456-4AE1-83A8-A07D030E3806} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {AE8BA5B8-AB1A-4188-AD15-23C3C4AFC9AA} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {AF020B79-0229-4EA0-A554-720FF839A1E8} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B1B2A0B3-4508-4B90-A224-792E5232CC6C} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B4470525-D54C-4C6E-827A-883B88CF9EB8} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B536FEF1-3367-4DC8-AE5F-D0748C2DAD4A} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B5DBF1F5-7560-48BE-8404-FE88D01AD249} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B7158317-EEE0-4C81-B1E2-215FC1FB5ED0} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B82B05F0-0A36-4B07-A6C8-081D40C5DE0A} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B88D248C-6E61-4E56-9996-2A409E1AEAAE} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {B8B37D4A-03E5-4F06-B5C5-1583734E5FDC} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {BCF8807D-F237-48EB-A40A-5ACEC7ADBF0E} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {CB50F729-31E2-4E56-B089-FC8641505607} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {CD3E56EE-77C7-4124-8000-5427682D6BDE} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: SDWin32 Class - {DF9B8CD9-C269-4022-88E2-92D463535AAE} - C:\WINNT\system32\khbtt.dll
O2 - BHO: (no name) - {E4280FFA-01B0-4CC8-B7EC-F87EABB188E0} - C:\Program Files\nls3vbri\nls3vbri.dll
O2 - BHO: (no name) - {F4EBD1B0-E66D-4824-B2E4-7A144795A466} - C:\Program Files\nls3vbri\nls3vbri.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [Kill Popup] C:\Program Files\Kill Popup\KillPopup.exe
O4 - HKLM\..\Run: [olphstn] "C:\WINNT\system32\olphstn.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINNT\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe
O4 - HKLM\..\Run: [Zxzytz] C:\Program Files\Uavrs\Wjoej.exe
O4 - HKLM\..\Run: [HPNT] C:\Program Files\hpdll\hpdll.exe
O4 - HKLM\..\Run: [Visual Element Fx] C:\Program Files\hpdll\tempdl\RAS012505.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [App32dll] C:\winnt\system32\msnavc32.exe lee0105
O4 - HKLM\..\Run: [nls3vbri] C:\Program Files\nls3vbri\nls3vbri.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [2Fmh36h] ntlorts.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [tetdxoe] C:\WINNT\system32\tetdxoe.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Jo5nRWNtV] nottsnmp.exe
O4 - HKCU\..\Run: [sysmonnt] C:\WINNT\system32\sysmonnt
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O12 - Plugin for .hpb: C:\Program Files\Internet Explorer\PLUGINS\nphpipb.dll
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {2EC77245-C97C-4F5E-80D1-9B280C4CD820} - http://download.mail...or/instmtdr.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150...ip/RdxIE601.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.googl...n/GoogleNav.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon....es/vzWebIns.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://recruitmax.w...bex/ieatgpc.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {E6A86FF2-AE57-11D3-B1F5-0010833427C9} - http://hpprintit.com/hpipb/pbsetup.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abac...abasetup144.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kindredpartners.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kindredpartners.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kindredpartners.com
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINNT\isrvs\mfiltis.dll
  • 0

Advertisements

#2
don77
Posted 06 March 2005 - 09:37 PM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Hi and welcome megapax
I m assuming your refering to this Topic
Please run a scan with the sugeested tools and run the online virus scans as well,
Post back a fresh log after you have done so and someone will pop by and help you get your machine cleared up,

Sorry for the late response been a bit busy around here
  • 0

#3
megapax
Posted 07 March 2005 - 08:09 AM

megapax

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Thank you for your response. After I posted this log, I realized it was a pretty lame considering I hadn't run any scans yet. I couldn't figure out how to delete it. So after I performed the scans, I created a new topic . I didn't think of just adding a response. What can I say I was in a malware inspired panic. I was able to resolve my problems with guidance through this other topoic. thank you again for your response, and sorry for unnecessarily occupying your time.
  • 0

#4
don77
Posted 07 March 2005 - 11:34 AM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Glad to hear you got it sorted out just the same,
Thanks for updating though, I really appreciate it
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP