[Janelle]

I am computer helpless. I have Norton Antivirus and Ad-Ware SE personal (free version). They are not able to remove various bargain buddy and spyware. I registered and completed cleanup, cwshredder, ad-ware SE, Spybot search and destroy, and windows update. The TDS-3 for Trojans locked my system so I removed it. Panda Activescan also idenified 9 infected files it could not remove. Ad-ware give me a list of C:/Restore/Temp. . . with a bunch of letters and numbers that can't be removed. I ran Hijack this and have attached my log. Do you want to see the Ad-ware log as well? Please help!

Logfile of HijackThis v1.99.1
Scan saved at 12:24:58 PM, on 5/21/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\GWMDMMSG.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\WUAUCLT.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\5NX5EQ5H\HIJACKTHIS[1].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimt.../aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://search.online-firms.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.ce1.attbb.net:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.ce1.attbb.net;<local>
R3 - Default URLSearchHook is missing
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: AIMSite Class - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} - C:\PROGRAM FILES\AIM TOOLBAR\AIMHELPER.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [requester] "C:\WINDOWS\SYSTEM\requester.10.exe"
O4 - HKLM\..\Run: [Desksite CMA] C:\Program Files\desksite\bin\cma.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://gateway.yahoo.com
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.n...E_5.3.0.228.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futurema...lobal/msc34.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab

[Advertisements]

Hi Janelle

We don't need the Adaware log at this stage. You might like to print this out as you won't be able to see this page while you are in Safe Mode.

Disable System Restore. See this page for how to do that http://www.pchell.co...emrestore.shtml

Please move HijackThis into a new folder - something like c:\HJT. It keeps backups and we are going to remove your temporary files as part of the cleanup work so we would lose it.

Make sure you still have the TDS-3 file you downloaded and the updates from this page http://tds.diamondcs...p?page=download Reinstall TDS-3 and the radius updates you downloaded. Don't run it yet.

Download and install Cleanup! from here http://www.spywareai...owsoftware&id=1
Run CleanUp!
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Download LSPFix from here. Don't run it yet

Make sure NewDotNet has gone. Go to Control Panel > Add/Remove Programs and remove it if it is listed there. If it is not there, go here and follow Procedure 4 here: http://www.newdotnet.com

If you lose internet connection after removing Newdotnet. We need to remove the newdotnet files from the LSP chain.

1. Run the LSPFix.exe that you just downloaded.
2. Check the I know what I'm doing box.
3. In the Keep box you should see one or more instances of newdotnet.dll.
4. Select every instance of newdotnet.dll and move each one to the Remove box by clicking the >> button.
5. When you are done click Finish>>.

Reboot into Safe Mode
http://service1.syma...src=sec_doc_nam

Open TDS-3 and let it do its preliminary scan. It will seem to stop for a while in a couple of places. When the first scan is finished and the screen says ready. Go to System in the top menu bar and select Full System Scan from the dropdown list. It will list everything it finds that is suspicious in the lower pane. Let it remove anything it tells you is confirmed as a trojan. The scan will take a long time in Safe Mode.

When TDS-3 has finished. Reboot into normal mode.

Do an online virus scan at each of these places - select to clean and select heuristics where that is offered. Save any log offered but don't post them unless asked.

http://housecall.tre.../start_corp.asp
http://www.bitdefend...can/licence.php
http://www.pandasoft...n_principal.htm

Reboot after each scan.

Do a new HijackThis log and post it here so that it can be reviewed. There will be more to do.

[ilago]

Hi Janelle

We don't need the Adaware log at this stage. You might like to print this out as you won't be able to see this page while you are in Safe Mode.

Disable System Restore. See this page for how to do that http://www.pchell.co...emrestore.shtml

Please move HijackThis into a new folder - something like c:\HJT. It keeps backups and we are going to remove your temporary files as part of the cleanup work so we would lose it.

Make sure you still have the TDS-3 file you downloaded and the updates from this page http://tds.diamondcs...p?page=download Reinstall TDS-3 and the radius updates you downloaded. Don't run it yet.

Download and install Cleanup! from here http://www.spywareai...owsoftware&id=1
Run CleanUp!
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Download LSPFix from here. Don't run it yet

Make sure NewDotNet has gone. Go to Control Panel > Add/Remove Programs and remove it if it is listed there. If it is not there, go here and follow Procedure 4 here: http://www.newdotnet.com

If you lose internet connection after removing Newdotnet. We need to remove the newdotnet files from the LSP chain.

1. Run the LSPFix.exe that you just downloaded.
2. Check the I know what I'm doing box.
3. In the Keep box you should see one or more instances of newdotnet.dll.
4. Select every instance of newdotnet.dll and move each one to the Remove box by clicking the >> button.
5. When you are done click Finish>>.

Reboot into Safe Mode
http://service1.syma...src=sec_doc_nam

Open TDS-3 and let it do its preliminary scan. It will seem to stop for a while in a couple of places. When the first scan is finished and the screen says ready. Go to System in the top menu bar and select Full System Scan from the dropdown list. It will list everything it finds that is suspicious in the lower pane. Let it remove anything it tells you is confirmed as a trojan. The scan will take a long time in Safe Mode.

When TDS-3 has finished. Reboot into normal mode.

Do an online virus scan at each of these places - select to clean and select heuristics where that is offered. Save any log offered but don't post them unless asked.

http://housecall.tre.../start_corp.asp
http://www.bitdefend...can/licence.php
http://www.pandasoft...n_principal.htm

Reboot after each scan.

Do a new HijackThis log and post it here so that it can be reviewed. There will be more to do.

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.