Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

a:b and CoolWebSearch won't go away [RESOLVED]


  • This topic is locked This topic is locked

#16
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Wow, you already got re-infected again!! We're going to have to basically start over! I'll be back asap!
  • 0

Advertisements


#17
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Let's see if anything is hiding from us...

First, run CleanUp! (so the scan won't take as long because cleanup will clear temporary files and cookies)

Then, please download Ewido Security Suite, install it, then be sure to update it (it won't scan until it's updated). Let it scan your computer (it may take a little while). Post the results from the scan.

This setup contains the free as well as the plus-version of the ewido security suite. After the installation, a free 14-day test version containing all the extensions of the plus-version will be activated. At the end of the test phase, the extensions of the plus version are deactivated and the freeware version can be used unlimited times. The purchased license code of the plus version can be entered at any time.


  • 0

#18
jaysin

jaysin

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
here you go.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 6:58:34 PM, 4/21/2005
+ Report-Checksum: A9674008

+ Date of database: 4/21/2005
+ Version of scan engine: v3.0

+ Duration: 34 min
+ Scanned Files: 166299
+ Speed: 80.38 Files/Second
+ Infected files: 45
+ Removed files: 45
+ Files put in quarantine: 45
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\
D:\

+ Scan result:
C:\hjt\backups\backup-20050419-223629-138.dll -> TrojanDropper.Small.tn -> Cleaned with backup
C:\Program Files\TightVNC\VNCHooks.dll -> Backdoor.WinVNC-based.b -> Cleaned with backup
C:\Program Files\TightVNC\WinVNC.exe -> Backdoor.WinVNC-based.b -> Cleaned with backup
C:\WIN2K\addtl32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\atljc.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\d3lh.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\d3zw32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\Downloaded Program Files\ieatgpc.dll -> Spyware.WebEx -> Cleaned with backup
C:\WIN2K\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b -> Cleaned with backup
C:\WIN2K\ipxd.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\ipxd.exe.bak -> TrojanDownloader.Agent.bq -> Cleaned with backup
C:\WIN2K\mfccg.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\mfcnn.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\msbg.exe -> Trojan.Agent.bi -> Cleaned with backup
C:\WIN2K\msfv32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\msmv32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\msqg.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\msqg.exe.bak -> TrojanDownloader.Agent.bq -> Cleaned with backup
C:\WIN2K\NDNuninstall6_38.exe -> Spyware.NewDotNet -> Cleaned with backup
C:\WIN2K\netef.exe -> Trojan.Agent.bi -> Cleaned with backup
C:\WIN2K\ntks.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\ntur.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\oqzdd.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WIN2K\sdkbt32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\sdkuu.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\addmo.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\addpe32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\adduc.exe -> TrojanDownloader.Agent.bq -> Cleaned with backup
C:\WIN2K\system32\apiek32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\appni32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\appzs32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\atltb32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\d3hb32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\ipdc32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\javaja32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\mfcoe.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\mfcva.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\netaa.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\netnw.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\ntcf.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\sdkxm32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\winhu32.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\winir.exe -> TrojanDownloader.Agent.bc -> Cleaned with backup
C:\WIN2K\system32\zkfiw.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WIN2K\winqc32.dll -> TrojanDropper.Small.tn -> Cleaned with backup


::Report End
  • 0

#19
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
That's a bunch of trojans! Will you post a new HiJackThis log please?
  • 0

#20
jaysin

jaysin

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Logfile of HijackThis v1.99.1
Scan saved at 12:12:08 AM, on 4/22/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\mspmspsv.exe
C:\WIN2K\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WIN2K\system32\pctspk.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Compuware\QALoad\PlayerAgent.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WIN2K\system32\ssstars.scr
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compuware Corporation
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {E0907FD1-0207-05B9-33F5-377394FC67A1} - C:\WIN2K\system32\msdu32.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [USBPAD] UsbPad.exe Install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Player Agent.lnk = C:\Program Files\Compuware\QALoad\plgui.exe
O4 - Global Startup: Test Execution Server.lnk = C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tesrv.exe
O4 - Global Startup: USB KeyPad.lnk = C:\WIN2K\USBPad.exe
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WIN2K\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WIN2K\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WIN2K\System32\Shdocvw.dll
O9 - Extra button: Phone Book - {AA0850BA-2281-4487-BB23-79CD86CD65F1} - http://compuapps1.co...jamorgchart.asp (file missing) (HKCU)
O9 - Extra button: Helpdesk - {E722A195-8277-4207-9DC0-5E9509DC3608} - http://compuweb.comp...lp/contacts.htm (file missing) (HKCU)
O9 - Extra button: Standards - {EEFB7A5F-FE31-4BDD-841C-1C291E928609} - http://compuweb.comp...ers/default.htm (file missing) (HKCU)
O9 - Extra button: Webmail - {F0035C52-A157-4528-A2C7-3155D3D3908B} - https://webmail1.com...hange/logon.asp (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://compuweb.compuware.com
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {5A447319-0EA2-447B-A063-A5F849B097D0} (ScanZillaLE Class) - https://www.stopzill...es/SZScanLE.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.co...loadControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://compuwaremc....bex/ieatgpc.cab
O16 - DPF: {FE4E8B9F-758D-4596-A4D4-37187B78A513} (DemoShield DemoNow Class) - http://aweb.nl.compu...ion/demonow.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D54343B9-A8E1-412B-B111-0C6148BEA62C}: Domain = compuware.com
O23 - Service: Workstation NetLogon Service ( 11F#`I) - Unknown owner - C:\WIN2K\netcd32.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WIN2K\System32\Ati2evxx.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE (file missing)
O23 - Service: Test Management Server (TmSrvService) - Compuware Corporation - C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tmsrv.exe
  • 0

#21
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Ok let's do this again...there is going to be a lot of rebooting! You'll probably want to print this out!

Reboot your computer into Safe Mode. You can do this by restarting your computer and continuously tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.

Run CWShredder
-Next, click on the: Fix button
-Follow the prompts, and press OK

Run AboutBuster and save the logs
*Browse to where you saved AboutBuster and run AboutBuster.exe.
*Click "OK" at the directions Read: Important! prompt.
*Click "Start" and then "OK" to allow AboutBuster to scan for Alternate Data Streams.
*Click "Yes" at the About:Buster prompt to allow it to shutdown explorer.exe.
*Please wait while AboutBuster scans your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
*When it has finished, click "Save Log...". Make sure you save it as I will need a copy of it.
Click "Exit" and "Exit" again to exit AboutBuster.

Run CleanUp!
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Run Ad-Aware
Reconfigure Ad-Aware for Full Scan as per the following instructions:
In the Ad-Aware main window, click on the gear icon at the top of the screen to open the preferences window. In the "General" window, make sure the following options are selected:
1) Automatically save log-file
2) Automatically quarantine objects prior to removal
3) Safe Mode (always request confirmation)

Click the "Scanning" button on the left-hand side and make sure the following options are selected:
1) Scan within archives
2) Scan active processes
3) Scan registry
4) Deep scan registry
4) Scan my IE Favorites for banned URLs
5) Scan my Hosts file

Please also click on "Select drives & folders to scan" and select your hard drive(s). Then click the "Advanced" button on the left-hand side and make sure all the options under "Log-file Detail Level" are selected. Next, click the "Tweak" button on the left-hand side. Click on "Scanning Engine" and make sure the following options are selected:
1) Unload recognized processes & modules during scanning
2) Obtain command line of scanned processes
3) Scan registry for all users instead of current user only

Click on "Cleaning Engine" and make sure the following options are selected:
1) Always try to unload modules before deletion
2) During removal, unload Explorer and IE if necessary
3) Let Windows remove files in use at next reboot
4) Delete quarantined objects after restoring

Finally, click on "Safety Settings" and make sure the following options are selected:
1) Automatically select problematic objects in results lists
2) Write-protect system files after repair (Hosts file, etc)

Click on "Proceed" to save the preferences. Then please click the "Start" button on the bottom left side to begin a scan. Select "Use custom scanning options" and then click "Next". Ad-Aware will then scan for malware. When it is finished, make sure any objects listed in RED are selected and click "Next" to remove the objects.

Reboot in normal mode.

Make sure you are disconnected from the Internet, all other programs and windows are closed and run HijackThis again. Please place a checkmark next to the following items, if they exist, and then click "FIX CHECKED":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WIN2K\system32\zkfiw.dll/sp.html#37049
R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {E0907FD1-0207-05B9-33F5-377394FC67A1} - C:\WIN2K\system32\msdu32.dll (file missing)

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab

O23 - Service: Workstation NetLogon Service ( 11F#`I) - Unknown owner - C:\WIN2K\netcd32.exe (file missing)


Close HiJack This and reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8, then highlighting "Safe Mode" on the menu then hitting enter. Delete the following files if found (in bold):

C:\WIN2K\system32\msdu32.dll
C:\WIN2K\system32\zkfiw.dll
C:\WIN2K\netcd32.exe

Reboot your computer into normal mode.

Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:

Workstation NetLogon Service (or possibly this: 11F#`I)

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok.

Open HiJackThis, click on "None of the above, just start the program". Now, click on the "Config" button (bottom right), then click on "Misc Tools", then click on "Delete an NT Service" a window will pop up. Enter the below item into that field (copy & paste!):

11F#`I

*IMPORTANT NOTE* Make sure there is a SPACE before the first "1" otherwise it won't work!

Click OK.

It should pull up information about the service, then ask if you want to reboot. Click YES.

Post a new HiJackThis log after it reboots and let me know if you received any error messages.
  • 0

#22
jaysin

jaysin

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
whew!
okay, here ya go.

The only thing weird I noticed, was when I double-clicked on the Workstation Netlogon Service, it gave me a configuration manager error, but then it still allowed me to disable and then delete it.
Plus, I actually got a start page when I started IE. wow. hopefully we're close (or done).

J



Logfile of HijackThis v1.99.1
Scan saved at 11:51:05 AM, on 4/22/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\mspmspsv.exe
C:\WIN2K\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WIN2K\system32\pctspk.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Compuware\QALoad\plgui.exe
C:\Program Files\Compuware\QALoad\PlayerAgent.exe
C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tesrv.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Compuware\cwaftrcsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compuware Corporation
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [USBPAD] UsbPad.exe Install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Player Agent.lnk = C:\Program Files\Compuware\QALoad\plgui.exe
O4 - Global Startup: Test Execution Server.lnk = C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tesrv.exe
O4 - Global Startup: USB KeyPad.lnk = C:\WIN2K\USBPad.exe
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WIN2K\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WIN2K\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WIN2K\System32\Shdocvw.dll
O9 - Extra button: Phone Book - {AA0850BA-2281-4487-BB23-79CD86CD65F1} - http://compuapps1.co...jamorgchart.asp (file missing) (HKCU)
O9 - Extra button: Helpdesk - {E722A195-8277-4207-9DC0-5E9509DC3608} - http://compuweb.comp...lp/contacts.htm (file missing) (HKCU)
O9 - Extra button: Standards - {EEFB7A5F-FE31-4BDD-841C-1C291E928609} - http://compuweb.comp...ers/default.htm (file missing) (HKCU)
O9 - Extra button: Webmail - {F0035C52-A157-4528-A2C7-3155D3D3908B} - https://webmail1.com...hange/logon.asp (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://compuweb.compuware.com
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {5A447319-0EA2-447B-A063-A5F849B097D0} (ScanZillaLE Class) - https://www.stopzill...es/SZScanLE.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.co...loadControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://compuwaremc....bex/ieatgpc.cab
O16 - DPF: {FE4E8B9F-758D-4596-A4D4-37187B78A513} (DemoShield DemoNow Class) - http://aweb.nl.compu...ion/demonow.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D54343B9-A8E1-412B-B111-0C6148BEA62C}: Domain = compuware.com
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WIN2K\System32\Ati2evxx.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE (file missing)
O23 - Service: Test Management Server (TmSrvService) - Compuware Corporation - C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tmsrv.exe
  • 0

#23
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Have you or your LAN Administrator set restrictions in Internet Explorer?

If not, run HiJackThis. Place a check next to the following item and click FIX CHECKED:

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

Close HiJackThis.

Do me a favor and shutdown your computer. Reboot and post a new HiJackThis log.
  • 0

#24
jaysin

jaysin

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Logfile of HijackThis v1.99.1
Scan saved at 12:40:43 PM, on 4/22/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\mspmspsv.exe
C:\WIN2K\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WIN2K\system32\pctspk.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Compuware\QALoad\plgui.exe
C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tesrv.exe
C:\Program Files\Compuware\QALoad\PlayerAgent.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Compuware\cwaftrcsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compuware Corporation
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.compuware.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [USBPAD] UsbPad.exe Install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Player Agent.lnk = C:\Program Files\Compuware\QALoad\plgui.exe
O4 - Global Startup: Test Execution Server.lnk = C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tesrv.exe
O4 - Global Startup: USB KeyPad.lnk = C:\WIN2K\USBPad.exe
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WIN2K\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WIN2K\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WIN2K\System32\Shdocvw.dll
O9 - Extra button: Phone Book - {AA0850BA-2281-4487-BB23-79CD86CD65F1} - http://compuapps1.co...jamorgchart.asp (file missing) (HKCU)
O9 - Extra button: Helpdesk - {E722A195-8277-4207-9DC0-5E9509DC3608} - http://compuweb.comp...lp/contacts.htm (file missing) (HKCU)
O9 - Extra button: Standards - {EEFB7A5F-FE31-4BDD-841C-1C291E928609} - http://compuweb.comp...ers/default.htm (file missing) (HKCU)
O9 - Extra button: Webmail - {F0035C52-A157-4528-A2C7-3155D3D3908B} - https://webmail1.com...hange/logon.asp (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://compuweb.compuware.com
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {5A447319-0EA2-447B-A063-A5F849B097D0} (ScanZillaLE Class) - https://www.stopzill...es/SZScanLE.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.co...loadControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://compuwaremc....bex/ieatgpc.cab
O16 - DPF: {FE4E8B9F-758D-4596-A4D4-37187B78A513} (DemoShield DemoNow Class) - http://aweb.nl.compu...ion/demonow.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D54343B9-A8E1-412B-B111-0C6148BEA62C}: Domain = compuware.com
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WIN2K\System32\Ati2evxx.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE (file missing)
O23 - Service: Test Management Server (TmSrvService) - Compuware Corporation - C:\Program Files\Compuware\QADirector\x86-win32\bin\qc_tmsrv.exe
  • 0

#25
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
How is it running??

I think Ewido helped us out a lot!
  • 0

Advertisements


#26
jaysin

jaysin

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
EXCELLENT so far.
I think you're right.

I still have a lot of files in my win2k and win2k/system32 dirs that are exe's with 0 KB.
Nothing seems wrong, they just look suspicious.

Thanks a ton for your help, you guys are awesome.
  • 0

#27
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Whenever you get a chance, post a new HijackThis log. If you want you can give me the name of the suspicious looking files to see if we need to get rid of them too :tazz:
  • 0

#28
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If your the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP