Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Danger Spyware active desktop

Started by engee , Mar 31 2005 07:41 AM

  • This topic is locked This topic is locked

#1
engee
Posted 31 March 2005 - 07:41 AM

engee

    New Member

  • Member
  • Pip
  • 1 posts
gday you guys are doin a great job here and ive got a little problem with that stupid DANGER: SPYWARE active desktop
Heres the logfile:

Logfile of HijackThis v1.99.1
Scan saved at 9:40:40 PM, on 31/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Winamp\winampa.exe
F:\Apps\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Java\jre1.5.0\bin\jusched.exe
I:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINDOWS\System32\ntddetect.exe
D:\WINDOWS\System32\rundll32.exe
D:\WINDOWS\Aqr.exe
D:\Program Files\wintidy\WinTidy.exe
F:\Apps\Microsoft AntiSpyware\gcasDtServ.exe
D:\WINDOWS\System32\mocih.exe
D:\WINDOWS\System32\dev32.exe
D:\WINDOWS\System32\nvsvc32.exe
I:\Program Files\iPOD\bin\iPodService.exe
D:\WINDOWS\System32\devldr32.exe
I:\Program Files\firefox.exe
D:\WINDOWS\System32\Services\{EEFDBDD4-E574-4F0C-A8D4-58ECAA77E290}\SVCHOST.EXE
D:\WINDOWS\System32\taskmgr.exe
F:\Downlads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\DOCUME~1\Matt\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\DOCUME~1\Matt\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6300E1C1-7AD2-4A71-B0AF-CC64C7908362} - D:\WINDOWS\System32\hobb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "F:\Apps\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] I:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EnergyPlugIn] D:\Program Files\EnergyPlugIn\EnergyPlugin.exe
O4 - HKLM\..\Run: [Ojr] D:\WINDOWS\System32\Hvb.exe
O4 - HKLM\..\Run: [ntddetect] D:\WINDOWS\System32\ntddetect.exe
O4 - HKLM\..\Run: [PayTime] D:\WINDOWS\System32\paytime.exe
O4 - HKLM\..\Run: [Nka] D:\WINDOWS\System32\Qud.exe
O4 - HKLM\..\Run: [Hao] D:\WINDOWS\Aqr.exe
O4 - HKLM\..\Run: [sp] rundll32 D:\DOCUME~1\Matt\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [Mve] D:\WINDOWS\System32\Iph.exe
O4 - HKLM\..\RunServices: [ntddetect] D:\WINDOWS\System32\ntddetect.exe
O4 - HKCU\..\Run: [PayTime] D:\WINDOWS\System32\paytime.exe
O4 - HKCU\..\Run: [Ojr] D:\WINDOWS\System32\Hvb.exe
O4 - HKCU\..\Run: [ntddetect] D:\WINDOWS\System32\ntddetect.exe
O4 - HKCU\..\Run: [Igd] D:\WINDOWS\Nhd.exe
O4 - HKCU\..\Run: [Nka] D:\WINDOWS\System32\Qud.exe
O4 - HKCU\..\Run: [Hao] D:\WINDOWS\Aqr.exe
O4 - HKCU\..\Run: [Mtq] D:\WINDOWS\System32\Vap.exe
O4 - HKCU\..\Run: [Srm] D:\WINDOWS\Gia.exe
O4 - HKCU\..\Run: [Abq] D:\WINDOWS\System32\Pmr.exe
O4 - HKCU\..\Run: [Bvn] D:\WINDOWS\The.exe
O4 - Startup: WinTidy.lnk = D:\Program Files\wintidy\WinTidy.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda..../aup/games4.cab
O18 - Filter: text/html - {FF6BEA94-A28C-4D8D-9C30-E85CE56B6D2D} - D:\WINDOWS\System32\hobb.dll
O18 - Filter: text/plain - {FF6BEA94-A28C-4D8D-9C30-E85CE56B6D2D} - D:\WINDOWS\System32\hobb.dll
O20 - Winlogon Notify: drct16 - D:\WINDOWS\SYSTEM32\drct16.dll
O23 - Service: Trace network connections (ACCRA) - Unknown owner - D:\WINDOWS\System32\mocih.exe
O23 - Service: Provides three management service (FreeBSD) - Unknown owner - D:\WINDOWS\System32\dev32.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - I:\Program Files\iPOD\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe


Thanks!
  • 0

Advertisements

#2
miekiemoes
Posted 31 March 2005 - 10:10 AM

miekiemoes

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 5,503 posts
  • MVP
Hi there,

It's better to print out the next instructions, because you also have to work in safe mode and this page wouldn't be available then.
Don't miss any steps!

* Download HSFix.zip
Create a new folder on your desktop and give it the name HSFix
UNZIP the content from HSFix.zip to the new folder HSFix

* Download and install CCleaner
Do not use it yet.

* Download FixregXp.reg and save it to your desktop!
Do not use it yet.

* Please set your system to show
all files; please see here if you're unsure how to do this.

* Download CWShredder. Start CWShredder and click FIX

*Start hijackthis and place a checkmark before the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\DOCUME~1\Matt\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\DOCUME~1\Matt\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {6300E1C1-7AD2-4A71-B0AF-CC64C7908362} - D:\WINDOWS\System32\hobb.dll
O4 - HKLM\..\Run: [EnergyPlugIn] D:\Program Files\EnergyPlugIn\EnergyPlugin.exe
O4 - HKLM\..\Run: [Ojr] D:\WINDOWS\System32\Hvb.exe
O4 - HKLM\..\Run: [ntddetect] D:\WINDOWS\System32\ntddetect.exe
O4 - HKLM\..\Run: [PayTime] D:\WINDOWS\System32\paytime.exe
O4 - HKLM\..\Run: [Nka] D:\WINDOWS\System32\Qud.exe
O4 - HKLM\..\Run: [Hao] D:\WINDOWS\Aqr.exe
O4 - HKLM\..\Run: [sp] rundll32 D:\DOCUME~1\Matt\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [Mve] D:\WINDOWS\System32\Iph.exe
O4 - HKLM\..\RunServices: [ntddetect] D:\WINDOWS\System32\ntddetect.exe
O4 - HKCU\..\Run: [PayTime] D:\WINDOWS\System32\paytime.exe
O4 - HKCU\..\Run: [Ojr] D:\WINDOWS\System32\Hvb.exe
O4 - HKCU\..\Run: [ntddetect] D:\WINDOWS\System32\ntddetect.exe
O4 - HKCU\..\Run: [Igd] D:\WINDOWS\Nhd.exe
O4 - HKCU\..\Run: [Nka] D:\WINDOWS\System32\Qud.exe
O4 - HKCU\..\Run: [Hao] D:\WINDOWS\Aqr.exe
O4 - HKCU\..\Run: [Mtq] D:\WINDOWS\System32\Vap.exe
O4 - HKCU\..\Run: [Srm] D:\WINDOWS\Gia.exe
O4 - HKCU\..\Run: [Abq] D:\WINDOWS\System32\Pmr.exe
O4 - HKCU\..\Run: [Bvn] D:\WINDOWS\The.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda..../aup/games4.cab
O18 - Filter: text/html - {FF6BEA94-A28C-4D8D-9C30-E85CE56B6D2D} - D:\WINDOWS\System32\hobb.dll
O18 - Filter: text/plain - {FF6BEA94-A28C-4D8D-9C30-E85CE56B6D2D} - D:\WINDOWS\System32\hobb.dll
O20 - Winlogon Notify: drct16 - D:\WINDOWS\SYSTEM32\drct16.dll
O23 - Service: Trace network connections (ACCRA) - Unknown owner - D:\WINDOWS\System32\mocih.exe
O23 - Service: Provides three management service (FreeBSD) - Unknown owner - D:\WINDOWS\System32\dev32.exe

*Close ALL open windows except hijackthis and click: fix checked.

* Boot your system into SAFE MODE.
°To get into the Safe mode as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu".
Use your arrow keys to move to "Safe Mode" and press your Enter key.

* Locate the HSFix-folder on your desktop, open it and doubleclick hsfix.bat
Allow it to run.

Using Windows Explorer, locate the following files/folders, and delete them (watch the spelling!!):

D:\WINDOWS\System32\ntddetect.exe
D:\WINDOWS\System32\mocih.exe
D:\WINDOWS\System32\dev32.exe
D:\WINDOWS\System32\Services <== this folder
D:\Program Files\EnergyPlugIn <== this folder
D:\WINDOWS\System32\Hvb.exe
D:\WINDOWS\System32\paytime.exe
D:\WINDOWS\System32\Qud.exe
D:\WINDOWS\Aqr.exe
D:\WINDOWS\System32\Iph.exe
D:\WINDOWS\Nhd.exe
D:\WINDOWS\System32\Vap.exe
D:\WINDOWS\Gia.exe
D:\WINDOWS\System32\Pmr.exe
D:\WINDOWS\The.exe

Search for other those 3-letter exe files (like the ones that are flagged above in your log..eg: D:\WINDOWS\System32\Qud.exe, D:\WINDOWS\System32\Vap.exe, D:\WINDOWS\The.exe ) that are present in your system32 and Windows-folder and delete them. To find them quickly, rightclick on one or two and choose properties. Check the filesize and date. They all must have the SAME filesize (most probably 8kb) and SAME date.
So, open your system32-folder and click on top in the menu for 'view'
Change the view to details and click on the header of the size column in order to sort the files on size.
Do the same for your Windows-folder.

Also search for a file called desktop.html and delete it.

* Go to start > control panel > Display properties > Desktop > Customize Desktop... > Web tab > uncheck and delete everything you find in there

* Doubleclick on FixregXp.reg you saved before on your desktop.
Answer Yes when prompted to add the contents to the registry

* Still in safe mode Run Ccleaner and click Run Cleaner (bottom right)

* Reboot your system back to normal again and do an online virusscan:
housecall and/or Bitdefender

* Reboot again and post a new HijackThis log together with the HSFix-log that you will find on C:/hslog.txt
  • 0

#3
miekiemoes
Posted 11 April 2005 - 07:10 AM

miekiemoes

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 5,503 posts
  • MVP
Due to inactivity, this thread will now be closed.
If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you.
Include the address of this thread in your request. If you should have a new issue, please start a new topic.
This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP