[demortiusnilnisibonum]

Hello,
A 'friend' of mine was viewing...some explicit websites and when I go to get on my computer I find that my background had been set to the Blue Screen Of Death, Windows 95 style with several links that hijacked my internet browser. After attempting to clean my system by deleting the following files ..system32/intmonp.exe, ..winnt/popuper.exe, ../system32/intmon.exe, ../system32/smss.exe, ../system32/csmss.exe and ../system32/shnlog.exe. My background has gone from BSOD to pure black and I still can not change it so I know there is something i'm missing. Here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 10:27:57 PM, on 6/2/2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\PE\BIN\ETSLAU~1.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoRT.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoTask.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\realmon.exe
C:\WINNT\System32\wuauclt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
G:\Program Files\Google\Gmail Notifier\gnotify.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Deskshield\PE\BIN\eTrustCIPE.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\SETI\[email protected]
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\System32\mdm.exe
G:\hjt\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Norton Personal Firewall - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\realmon.exe"
O4 - HKLM\..\Run: [eTrustCIPE] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Deskshield\PE\BIN\EZDSMain.EXE"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinProfile] sndcfg16.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe /disabled
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] G:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] G:\Program Files\Norton Personal Firewall\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINNT\System32\msmsgs.exe
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [seticlient] g:\SETI\[email protected] -min
O4 - Startup: Drempels Desktop.lnk = C:\WINNT\drempels.exe
O4 - Global Startup: eTrust EZ Firewall.lnk = C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\efpeadm.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: eTrust VPN (eTrustVPN Services) - Unknown owner - C:\Program Files\eTrust\VPN\evpnsvc.exe
O23 - Service: ETSLauncher - Unknown owner - C:\PROGRA~1\CA\ETRUST~1\ETRUST~3\PE\BIN\ETSLAU~1.EXE
O23 - Service: eTrust EZ Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoRT.exe
O23 - Service: eTrust EZ Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoTask.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - G:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Mouse Hardware Sync (mousehs) - Unknown owner - C:\WINNT\System32\mousehs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

Any ideas and thanks for the help!

[Advertisements]

Hello! While we appreciate the fact that you want to help out, we do not allow non-Staff Members to post help on the boards. There are too many things that could go wrong, and too many Malwares that can make themselves look "legitimate". Many times, there are special tools and fixes that need to be used, and our Staff Members are trained to recognize and clean these infections.

If you are interested in training to become a Staff Member, please post Here

Thank you for your cooperation!

Kat
GeeksToGo Administrator

Edited by ~Kat~, 02 June 2005 - 11:29 PM.

[Jedi]

Hello! While we appreciate the fact that you want to help out, we do not allow non-Staff Members to post help on the boards. There are too many things that could go wrong, and too many Malwares that can make themselves look "legitimate". Many times, there are special tools and fixes that need to be used, and our Staff Members are trained to recognize and clean these infections.

If you are interested in training to become a Staff Member, please post Here

Thank you for your cooperation!

Kat
GeeksToGo Administrator

Edited by ~Kat~, 02 June 2005 - 11:29 PM.

[Jedi]

nm

Edited by Jedi, 03 June 2005 - 01:29 AM.

[demortiusnilnisibonum]

Hello! While we appreciate the fact that you want to help out, we do not allow non-Staff Members to post help on the boards. There are too many things that could go wrong, and too many Malwares that can make themselves look "legitimate". Many times, there are special tools and fixes that need to be used, and our Staff Members are trained to recognize and clean these infections.

If you are interested in training to become a Staff Member, please post Here

Thank you for your cooperation!

Kat
GeeksToGo Administrator

Jedi, if you could email what you think i'm willing to try almost anything.

[gerryf]

Please go to the malware forum in my signature and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[demortiusnilnisibonum]

Alright. Thanks