[stpbrewer]

Norton is reporting that I have a trojan horse called oeo8atwq5.exe that it cannot remove.

Any ideas?

Thanks for any assistance you may be able to provide.

My Hijack This logfile is below:

Logfile of HijackThis v1.99.0
Scan saved at 2:44:58 PM, on 2/26/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\oeoiatwq5.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\System32\iprkager.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\Explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {11767632-3A17-97C3-2CE3-4DB4F9E2E13A} - C:\WINNT\atlbt32.dll (file missing)
O2 - BHO: (no name) - {615F6DE2-33B2-8FAA-C961-23BB2FCF20FB} - (no file)
O2 - BHO: (no name) - {7537DE90-EF62-B178-5516-580D90A4C107} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {EA7EC6E9-C480-5FE0-3A3E-C74A010E5F18} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [2.tmp] C:\DOCUME~1\JEFFKO~1.JEF\LOCALS~1\Temp\2.tmp.exe 1 10001
O4 - HKLM\..\Run: [ntechin] C:\WINNT\system32\n20050308.exe
O4 - HKLM\..\Run: [Dvx] C:\WINNT\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [AutoLoaderwwok1RKjZQLM] "C:\WINNT\System32\ircchat.exe"
O4 - HKLM\..\Run: [w37O3FX] ircchat.exe
O4 - HKLM\..\Run: [Microsoft Internet Acceleration Utility] iau.exe
O4 - HKLM\..\Run: [syszk32.exe] C:\WINNT\system32\syszk32.exe
O4 - HKLM\..\Run: [vmss] C:\WINNT\System32\vmss\vmss.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [netan.exe] C:\WINNT\system32\netan.exe
O4 - HKLM\..\Run: [apixv.exe] C:\WINNT\system32\apixv.exe
O4 - HKLM\..\Run: [atldv32.exe] C:\WINNT\system32\atldv32.exe
O4 - HKLM\..\Run: [msxp.exe] C:\WINNT\system32\msxp.exe
O4 - HKLM\..\Run: [ipfu.exe] C:\WINNT\system32\ipfu.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [D.tmp] C:\DOCUME~1\JEFFKO~1.JEF\LOCALS~1\Temp\D.tmp.exe 2 10001
O4 - HKLM\..\Run: [netzy.exe] C:\WINNT\system32\netzy.exe
O4 - HKLM\..\Run: [D.tmp.exe] C:\DOCUME~1\JEFFKO~1.JEF\LOCALS~1\Temp\D.tmp.exe 4 10001
O4 - HKCU\..\Run: [h0oERPbpe] iprkager.exe
O4 - HKCU\..\Run: [Microsoft Internet Acceleration Utility] iau.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O10 - Unknown file in Winsock LSP: c:\winnt\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\dolsp.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: http://*.windupdates.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: mlnjddmizork - Unknown - C:\WINNT\System32\oeoiatwq5.exe
O23 - Service: Workstation NetLogon Service - Unknown - C:\WINNT\system32\javacw.exe (file missing)

[Advertisements]

Hi stpbrewer

For anyone using Windows XP, 'Search' will not automatically show hidden files even if your folder options settings are set to do that. Do this so you can see hidden files and folders - click here http://www.davehigha...ds/xphidden.zip to download xphidden.zip. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

Please set your system to show all files; see here for how to do this if you're unsure.

Please read through the instructions before you start (you may want to print this out).

First download LSPFix by clicking here:

Please, make sure that all browser windows and internet connections are closed. Run the program (LSPFix) and click the "I know what I'm doing" box. Highlite all instances of dolsp.dll and move them to the "Remove" side and click finish. Don't remove anything else there.

c:\windows\system32\dolsp.dll
c:\windows\system32\dolsp.dll
c:\windows\system32\dolsp.dll
c:\windows\system32\dolsp.dll

Close all programs down, leaving only HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://
O2 - BHO: (no name) - {11767632-3A17-97C3-2CE3-4DB4F9E2E13A} - C:\WINNT\atlbt32.dll (file missing)
O2 - BHO: (no name) - {615F6DE2-33B2-8FAA-C961-23BB2FCF20FB} - (no file)
O2 - BHO: (no name) - {7537DE90-EF62-B178-5516-580D90A4C107} - (no file)
O2 - BHO: (no name) - {EA7EC6E9-C480-5FE0-3A3E-C74A010E5F18} - (no file)
O4 - HKLM\..\Run: [ntechin] C:\WINNT\system32\n20050308.exe
O4 - HKLM\..\Run: [Dvx] C:\WINNT\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [AutoLoaderwwok1RKjZQLM] "C:\WINNT\System32\ircchat.exe"
O4 - HKLM\..\Run: [w37O3FX] ircchat.exe
O4 - HKLM\..\Run: [Microsoft Internet Acceleration Utility] iau.exe
O4 - HKLM\..\Run: [syszk32.exe] C:\WINNT\system32\syszk32.exe
O4 - HKLM\..\Run: [vmss] C:\WINNT\System32\vmss\vmss.exe
O4 - HKLM\..\Run: [netan.exe] C:\WINNT\system32\netan.exe
O4 - HKLM\..\Run: [apixv.exe] C:\WINNT\system32\apixv.exe
O4 - HKLM\..\Run: [atldv32.exe] C:\WINNT\system32\atldv32.exe
O4 - HKLM\..\Run: [msxp.exe] C:\WINNT\system32\msxp.exe
O4 - HKLM\..\Run: [ipfu.exe] C:\WINNT\system32\ipfu.exe
O4 - HKLM\..\Run: [D.tmp] C:\DOCUME~1\JEFFKO~1.JEF\LOCALS~1\Temp\D.tmp.exe 2 10001
O4 - HKLM\..\Run: [netzy.exe] C:\WINNT\system32\netzy.exe
O4 - HKLM\..\Run: [D.tmp.exe] C:\DOCUME~1\JEFFKO~1.JEF\LOCALS~1\Temp\D.tmp.exe 4 10001
O4 - HKCU\..\Run: [h0oERPbpe] iprkager.exe
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: http://*.windupdates.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O23 - Service: Workstation NetLogon Service - Unknown - C:\WINNT\system32\javacw.exe (file missing)

Click on Fix Checked and exit HijackThis.

Reboot into Safe Mode: see here if you don't know how to do this.

Using Windows Explorer, locate the following files/folders, and delete them: If Found

C:\WINNT\atlbt32.dll <--Delete this file
C:\WINNT\System32\wsxsvc\wsxsvc.exe <--Delete the whole folder
C:\WINNT\System32\ircchat.exe<--Delete this file
iau.exe<--Delete this file
C:\WINNT\system32\syszk32.exe<--Delete this file
C:\WINNT\System32\vmss\vmss.exe<--Delete the whole folder
C:\WINNT\system32\netan.exe<--Delete this file
C:\WINNT\system32\apixv.exe<--Delete this file
C:\WINNT\system32\atldv32.exe<--Delete this file
C:\WINNT\system32\msxp.exe<--Delete this file
C:\WINNT\system32\ipfu.exe<--Delete this file
C:\DOCUME~1\JEFFKO~1.JEF\LOCALS~1\Temp\<--Delete all file in this folder
C:\WINNT\system32\netzy.exe <--Delete this file
C:\WINNT\system32\javacw.exe <--Delete this file

Exit Explorer, and reboot as normal afterwards.

Post back a fresh HijackThis log and we'll take another look.

Kc