[ellis067]

Pieter,

Here is a copy of my C drive scan. It could not delete some of the programs.
Scan Control Dumped @ 09:57:42 18-04-05
(DELETED) Suspicious Filename: Dual extensions
File: c:\documents and settings\blakeley\my documents\firefoxsetup-0.9.1.exe

(DELETED) Positive identification: Worm.Bagle.e
File: c:\documents and settings\brandon\local settings\temp\ccaeab\jqewfagf.exe

(DELETED) Positive identification: Adware.EZula.g1
File: c:\documents and settings\brandon\local settings\temporary internet files\content.ie5\o8nptops\119[1].bin

(DELETED) Positive identification <Adv>: Possible WebDownloader
File: c:\documents and settings\brandon\local settings\temporary internet files\content.ie5\o8nptops\wintask[1].exe

(DELETED) Positive identification <Adv>: Possible WebDownloader
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp287\a0056203.exe

(DELETED) Positive identification <Adv>: Possible WebDownloader
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp288\a0057523.exe

(DELETED) Positive identification: Adware.EZula.g2
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp289\a0061597.exe

(DELETED) Positive identification: Adware.EZula.g
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp289\a0061603.exe

(DELETED) Positive identification: Adware.EZula.g1
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp289\a0061604.exe

(DELETED) Positive identification: Trojan.Win32.Small.i
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp290\a0064645.exe

(DELETED) Positive identification (embedded in file): Trojan.Win32.Small.i
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp290\a0064646.exe

(DELETED) Positive identification: Trojan.Win32.Small.i
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp291\a0064724.exe

(DELETED) Positive identification (embedded in file): Trojan.Win32.Small.i
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp291\a0064725.exe

(DELETED) Positive identification: Trojan.Win32.Small.i
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp291\a0068808.exe

(DELETED) Positive identification: Worm.Bagle.e
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp302\a0078161.exe

(DELETED) Positive identification (DLL): Worm.Bagle.e (dll)
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp302\a0078162.exe

(DELETED) Positive identification <Adv>: Possible WebDownloader
File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp306\a0090351.exe

Positive identification (DLL): Adware.Wurld.d (dll)
File: c:\windows\system32\azkku.dll

Positive identification <Adv>: Possible WebDownloader
File: c:\windows\system32\qcap.exe

Positive identification: TrojanDropper.Win32.Small.fl
File: c:\windows\system32\setup66.exe

Positive identification: Adware.EZula.g1
File: c:\windows\system32\cache\advtg.exe

Positive identification: Adware.EZula.g1
File: c:\windows\system32\cache\ezstub.exe

Positive identification <Adv>: Suspicious: Microsoft-tagged exe built with Borland compiler
File: c:\windows\system32\cache\helperinstall.exe

Positive identification (embedded in file): Trojan.Win32.Small.i
File: c:\windows\system32\cache\omi.exe

Positive identification <Adv>: Possible WebDownloader
File: c:\windows\system32\cache\pop.exe

Positive identification (embedded in file): TrojanDropper.Win32.Small.fl
File: c:\windows\system32\cache\setupwrapper.exe

Positive identification <Adv>: Possible WebDownloader
File: c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\4pq7052j\protector_update[1].exe

Should I go find these files and delete them. Let me know and thanks again.

Brandon


P.S. Here is my HJT log
Logfile of HijackThis v1.99.1
Scan saved at 6:40:45 PM, on 4/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Prevx Home\PXAgent.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\program files\mcafee.com\vso\mcvsshld.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Prevx Home\SAGUI.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system\inuials.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\D-Link AirPlus Xtreme G DWL-G650\AIRPLUS.exe
C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Documents and Settings\Brandon\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.al.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrevxHome] C:\Program Files\Prevx Home\SAGUI.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: D-Link AirPlus Xtreme G DWL-G650 Adapter Utility.lnk = C:\Program Files\D-Link AirPlus Xtreme G DWL-G650\AIRPLUS.exe
O4 - Global Startup: MA521 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe (file missing)
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abac...abasetup144.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Prevx Agent (PrevxAgent) - Prevx Ltd. - C:\Program Files\Prevx Home\PXAgent.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[Advertisements]

First disable System restore
Reboot
Re-enable System Restore
Additional info how-to: http://service1.syma...src=sec_doc_nam

Open Internet Explorer (IE) and click Tools then Internet Options on the tool bar.
Then click on Delete Files.
Make sure you put a checkmark in "Delete all offline content" before you click "OK" when doing that.

In HijackThis fix:
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe (file missing)

reboot once more and run a new scan.
Let us know what's left.

Regards,

Pieter

[Metallica]

First disable System restore
Reboot
Re-enable System Restore
Additional info how-to: http://service1.syma...src=sec_doc_nam

Open Internet Explorer (IE) and click Tools then Internet Options on the tool bar.
Then click on Delete Files.
Make sure you put a checkmark in "Delete all offline content" before you click "OK" when doing that.

In HijackThis fix:
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe (file missing)

reboot once more and run a new scan.
Let us know what's left.

Regards,

Pieter

[ellis067]

Thanks Pieter,

I will try that and let you know


Brandon

[Metallica]

OK. Looking forward to see a (hopefully clean) log.

Rgards,

Pieter

[ellis067]

Pieter,

I did what you said and this is my new HJT Log. I have not had any pop-ups yet but have been experiencing troubles getting onto the internet. I will let you know what happens.

Thanks again,
Brandon



Logfile of HijackThis v1.99.1
Scan saved at 7:56:24 PM, on 4/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Prevx Home\PXAgent.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\program files\mcafee.com\vso\mcvsshld.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Prevx Home\SAGUI.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system\inuials.exe
C:\Program Files\D-Link AirPlus Xtreme G DWL-G650\AIRPLUS.exe
C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\Brandon\Desktop\HijackThis.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.al.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrevxHome] C:\Program Files\Prevx Home\SAGUI.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: D-Link AirPlus Xtreme G DWL-G650 Adapter Utility.lnk = C:\Program Files\D-Link AirPlus Xtreme G DWL-G650\AIRPLUS.exe
O4 - Global Startup: MA521 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abac...abasetup144.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Prevx Agent (PrevxAgent) - Prevx Ltd. - C:\Program Files\Prevx Home\PXAgent.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[ellis067]

I spoke too soon Pieter. I now have a ton of IE clicking noises, but no pop-ups are appearing. I had two a while back from searchingbooth and deskwizz. Please get me some help. so I can use my computer unde normal use.

PLEASE HELP!

Brandon

[Metallica]

Can you do a find files for:

IEXPLOR.EXE <= note the spelling
setup.ini

Let me know if and where you find them.

Regards,

Pieter

[ellis067]

I could not find any of the files you wanted. There is an application called tp7543 that is in my local\temp folder and I keep deleting it and it keeps coming back after restart. I know that this file is trying to write other applications in my system 32 folder. There is also rknpln.exe located in system32 and it will not delete and usually will not end as a proccess. I think if i can get rid of these and system32\cmonqoa.exe and other programs in this location, then i will gain better performance.

Please see if anyone has heard of these and how to get rid of them.

Thanks Pieter,

Brandon

[Metallica]

Download, install, and run CleanUp!

Run a virus scan, please use ActiveScan - Save the results from the scan!

Regards,

Pieter

[ellis067]

Thanks,

I am using cleanup right now, and i will post panda log soon.

brandon

[Metallica]

Good Cleanup should take care of the Temp folders.

Run it in safe mode again after the virusscan if necessary.

Regards,

Pieter

[ellis067]

Hey

here is my second cleanup log. After reboot it could not delete the files tp7543. I am currently running the virus scan and will reboot in safe mode and cleanup again. It is frustrating because this tp7543 file comes back after every restart.

I will post virus scan once completed.

Thanks

[Metallica]

Something is creating that file in the Temp folders. Hopefully the scan will unearth it.

Regards,

Pieter

[ellis067]

Hey Peiter,

I can't finish the virus scan before my computer freezes up. It seems acoording to task manager (processes) that most of my pop-ups are coming from inuals.exe or something like that.. When my computer boots up it barely uses that process, but after internet stays on for about 20 min it shows usage of up to 21,000 K. I will continue to try virus scan and post as soon as I can. Sorry for the delay, but i will keep in touch.

Thanks,
Brandon

[Metallica]

Hi Brandon,

Did you actually find that file on your computer?
If so, can you send it to me?

Regards,