Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Please Help [RESOLVED]

Started by jld4523 , Jun 10 2005 10:59 PM

  • This topic is locked This topic is locked

#1
jld4523
Posted 10 June 2005 - 10:59 PM

jld4523

    New Member

  • Member
  • Pip
  • 4 posts
ever since I had my computer worked on, I've had serious issues. The computer is slow, always freezes, etc. It never happened before, so I think the guy installed something I didn't want on the computer. I've tried a few spyware removal tools, but still have issues. Please help! below is my hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 12:51:26 AM, on 6/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\CABINET4.exe
C:\WINDOWS\System32\winldra1.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\r?gedit.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\AIM\aim.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Annie Easterly\Local Settings\Temporary Internet Files\Content.IE5\W5AJ0P2F\hijackthis[1]\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimt.../aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {02751F81-9085-48FA-A2DA-E2B2B0EBBAD1} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {04CEC015-273B-4EE8-AF5B-CFF9E85BDA87} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EF5181A-9AA8-47F2-AAF3-00719D153666} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {1209BB8C-36DD-4010-8CF1-45C75DD5F30D} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {15EA4131-CA7D-4CBA-A3F4-30847B1A028C} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {1D16299B-D08C-480F-B699-2138DC03A77A} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {48BCDFC3-8570-4E07-9526-C259617DE432} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {4A6AF96A-4DDD-4606-9490-BFA80D23A3D5} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {60FF117B-5843-4802-9748-95182E1B9E52} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {6708E2DB-FF50-4B09-8E5F-904BE30CA86B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {6EE00FD7-0E27-408F-B8BE-2FC226C5E17F} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {8ADE1059-2A95-45CE-B6DE-F92A8776A1B1} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {AA786485-45CB-458B-A068-465E814892E4} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {BF0DB5C7-37F1-4B59-AC1D-DE04BED6FB43} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {CA42339D-8A1C-4088-B24D-9C2BE110C66A} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {D4DBD28F-55B6-4F28-9C40-66005F0DA647} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {E20AFC9E-81EB-4336-BBAC-05F0E270E109} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {EA6EFE3B-CCE2-4870-A179-8CB6BEFCDB1B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O2 - BHO: (no name) - {FF9E9E5E-B074-400D-808A-50506753E335} - C:\Program Files\CSBB\CSBB.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O4 - HKLM\..\Run: [n2ke2cVER] C:\documents and settings\annie easterly\local settings\temp\n2ke2cVER.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [9671802bf692] C:\WINDOWS\System32\CABINET4.exe
O4 - HKLM\..\Run: [zJs7] C:\documents and settings\annie easterly\local settings\temp\zJs7.exe
O4 - HKLM\..\Run: [4Me] C:\documents and settings\annie easterly\local settings\temp\4Me.exe
O4 - HKLM\..\Run: [bABz] C:\documents and settings\annie easterly\local settings\temp\bABz.exe
O4 - HKLM\..\Run: [load32] C:\WINDOWS\System32\winldra1.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [745ddf5d3d68] C:\WINDOWS\System32\BATMETER.exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\ANNIEE~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Eqhd] C:\WINDOWS\System32\r?gedit.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emory.webex....bex/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

Advertisements

#2
loophole
Posted 14 June 2005 - 07:52 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hello :tazz:

Sorry for the delayed response, it has been very busy lately.

If you still require help please post a new Hijack log in this
thread and I will help you.

Thanks
  • 0

#3
jld4523
Posted 14 June 2005 - 10:34 PM

jld4523

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
thanks for your help.

I've run some various scans since last time, Ewido, Ad-Aware, Clean-Up. It got a little better, but it's still pretty slow and freezes occasionally.

here's the hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 12:29:49 AM, on 6/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\CABINET4.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\System32\r?gedit.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\FirstClass\Fcc32.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Annie Easterly\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimt.../aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {02751F81-9085-48FA-A2DA-E2B2B0EBBAD1} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {04CEC015-273B-4EE8-AF5B-CFF9E85BDA87} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EF5181A-9AA8-47F2-AAF3-00719D153666} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {1209BB8C-36DD-4010-8CF1-45C75DD5F30D} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {15EA4131-CA7D-4CBA-A3F4-30847B1A028C} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {1D16299B-D08C-480F-B699-2138DC03A77A} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {48BCDFC3-8570-4E07-9526-C259617DE432} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {4A6AF96A-4DDD-4606-9490-BFA80D23A3D5} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {60FF117B-5843-4802-9748-95182E1B9E52} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {6708E2DB-FF50-4B09-8E5F-904BE30CA86B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {6EE00FD7-0E27-408F-B8BE-2FC226C5E17F} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {8ADE1059-2A95-45CE-B6DE-F92A8776A1B1} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {AA786485-45CB-458B-A068-465E814892E4} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {BF0DB5C7-37F1-4B59-AC1D-DE04BED6FB43} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {CA42339D-8A1C-4088-B24D-9C2BE110C66A} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {D4DBD28F-55B6-4F28-9C40-66005F0DA647} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {E20AFC9E-81EB-4336-BBAC-05F0E270E109} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {EA6EFE3B-CCE2-4870-A179-8CB6BEFCDB1B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O2 - BHO: (no name) - {FF9E9E5E-B074-400D-808A-50506753E335} - C:\Program Files\CSBB\CSBB.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [9671802bf692] C:\WINDOWS\System32\CABINET4.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [745ddf5d3d68] C:\WINDOWS\System32\BATMETER.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Eqhd] C:\WINDOWS\System32\r?gedit.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emory.webex....bex/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#4
loophole
Posted 14 June 2005 - 11:41 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hello

Lets get you fixed up

Please print out a copy of these instructions

Download and install CleanUp! Here or here CleanUp!Dont use it yet

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimt.../aimtoolbar.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimt.../aimtoolbar.jsp
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {02751F81-9085-48FA-A2DA-E2B2B0EBBAD1} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {04CEC015-273B-4EE8-AF5B-CFF9E85BDA87} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {0EF5181A-9AA8-47F2-AAF3-00719D153666} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {1209BB8C-36DD-4010-8CF1-45C75DD5F30D} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {15EA4131-CA7D-4CBA-A3F4-30847B1A028C} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {1D16299B-D08C-480F-B699-2138DC03A77A} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {48BCDFC3-8570-4E07-9526-C259617DE432} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {4A6AF96A-4DDD-4606-9490-BFA80D23A3D5} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {60FF117B-5843-4802-9748-95182E1B9E52} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {6708E2DB-FF50-4B09-8E5F-904BE30CA86B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {6EE00FD7-0E27-408F-B8BE-2FC226C5E17F} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {8ADE1059-2A95-45CE-B6DE-F92A8776A1B1} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {AA786485-45CB-458B-A068-465E814892E4} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {BF0DB5C7-37F1-4B59-AC1D-DE04BED6FB43} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {CA42339D-8A1C-4088-B24D-9C2BE110C66A} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {D4DBD28F-55B6-4F28-9C40-66005F0DA647} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {E20AFC9E-81EB-4336-BBAC-05F0E270E109} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {EA6EFE3B-CCE2-4870-A179-8CB6BEFCDB1B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {FF9E9E5E-B074-400D-808A-50506753E335} - C:\Program Files\CSBB\CSBB.dll (file missing)
O4 - HKLM\..\Run: [9671802bf692] C:\WINDOWS\System32\CABINET4.exe
O4 - HKLM\..\Run: [745ddf5d3d68] C:\WINDOWS\System32\BATMETER.exe
O4 - HKCU\..\Run: [Eqhd] C:\WINDOWS\System32\r?gedit.exe

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

Show Hidden Files and Folders (if needed)
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Please uninstall the following(if present) Click Start>>>control panel>>>add/remove (If present)
CSBB

Using windows explorer( right click start, left click explore)
Search for and delete these files and folders (If found)
C:\WINDOWS\System32\CABINET4.exe
C:\WINDOWS\System32\BATMETER.exe
C:\WINDOWS\System32\r?gedit.exe<< ensure it is this one and no other
C:\Program Files\CSBB

Now run cleanup

Reboot your computer

Then, run this online virus scan:
ActiveScan

Save the results from ActiveScan.

I need you to post the log from Ewido, the log from ActiveScan, and a new HiJackThis log into this topic.
  • 0

#5
jld4523
Posted 23 June 2005 - 07:34 PM

jld4523

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Sorry for the delay, I was on vacation :tazz: Thanks for your help!

I did the things that you said, and below are the results of Ewido, Hijack This and Active Scan. I noticed the batmeter.exe file that you mentioned was in Ewido quarantine. Should I go ahead and remove it? I'm also including the Ewido log from the first time I ran, just in case it's useful.

+ Created on: 12:01:38 PM, 6/11/2005
+ Report-Checksum: B8E480D8

+ Date of database: 6/11/2005
+ Version of scan engine: v3.0

+ Duration: 54 min
+ Scanned Files: 56851
+ Speed: 17.51 Files/Second
+ Infected files: 113
+ Removed files: 113
+ Files put in quarantine: 113
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@21250453[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@237246[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@247realmedia[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@37899602[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@50878308[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@59839560[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@66693905[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@70406058[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@8683723[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@abcsearch[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@adknowledge[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@adtrak[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@advertising[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@bfast[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@bluestreak[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@burstnet[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@cgi-bin[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@clickagents[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@com[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@dcsc5gygh5twkfn4glhfks28p_9f8m[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@dcspmlfn66twkfocu55nbix84_4c4t[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@dcss9l0ug21e5h6ugmb32ovpd_2s8i[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@dcswkdum9pljwpslkirxaz7o5_7t5n[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@debtsettlementusa[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@doubleclick[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@exitexchange[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@fastclick[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@fastclick[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@geocities[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@hitbox[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@html[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@indiads[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@linksynergy[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@LPneimanmarcus[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@overture[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@ping[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@realmedia[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@real[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@S005-01-10-9-283716-108780[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@S005-01-4-23-215286-70858[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@S111746[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@S133857[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@S135975[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@spylog[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@targetnet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@tradedoubler[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@tribalfusion[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@valueclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@xiti[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Cookies\annie easterly@zedo[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Local Settings\Temp\temp.frE291\CSBB.DLL -> Spyware.ClearSearch.u -> Cleaned with backup
C:\Documents and Settings\Annie Easterly\Local Settings\Temp\temp.frE65F -> TrojanDownloader.VB.em -> Cleaned with backup
C:\I386\NETMEET.HTM -> Worm.Nimda -> Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug.a -> Cleaned with backup
C:\Program Files\NetMeeting\netmeet.htm -> Worm.Nimda -> Cleaned with backup
C:\WINDOWS\dvpd.dll -> Backdoor.Dumador.as -> Cleaned with backup
C:\WINDOWS\prntsvra.dll -> Backdoor.Small.cm -> Cleaned with backup
C:\WINDOWS\SYSTEM32\ADSLDPC6.exe -> Spyware.UrlSpy -> Cleaned with backup
C:\WINDOWS\SYSTEM32\ADVAPI32.exe -> Spyware.AdSrve -> Cleaned with backup
C:\WINDOWS\SYSTEM32\BOOTVID9.exe -> Spyware.AdSrve.a -> Cleaned with backup
C:\WINDOWS\SYSTEM32\lsasrv.exe -> Worm.Mydoom.ak -> Cleaned with backup
C:\WINDOWS\SYSTEM32\Searchx.htm -> Spyware.TwainTech -> Cleaned with backup
C:\WINDOWS\winsms.dll -> Backdoor.Dumador.as -> Cleaned with backup
C:\WINDOWS\wt\wtupdates\webd\4.1.1\files\wtvh.dll -> Spyware.WildTangent.b -> Cleaned with backup
C:\WINDOWS\wt\wtvh.dll -> Spyware.WildTangent.b -> Cleaned with backup


::Report End

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 5:44:42 PM, 6/23/2005
+ Report-Checksum: E639CEC5

+ Date of database: 6/23/2005
+ Version of scan engine: v3.0

+ Duration: 44 min
+ Scanned Files: 49892
+ Speed: 18.54 Files/Second
+ Infected files: 1
+ Removed files: 1
+ Files put in quarantine: 1
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP3\A0011099.exe -> Spyware.UrlSpy -> Cleaned with backup


::Report End

Incident Status Location

Adware:Adware/eZula No disinfected Windows Registry
Adware:Adware/SideSearch No disinfected C:\WINDOWS\sepsd.bin
Adware:Adware/IEDriver No disinfected Windows Registry
Virus:Bck/Dumador.O Disinfected Operating system
Adware:Adware Program No disinfected C:\WINDOWS\Downloaded Program Files\ieatgpc.inf
Adware:Adware/SideSearch No disinfected C:\WINDOWS\sepsd.bin
Adware:Adware/IEDriver No disinfected C:\WINDOWS\SYSTEM32\BROWSEUI.exe
Adware:Adware/IEDriver No disinfected C:\WINDOWS\SYSTEM32\CMDIAL32.exe
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\1.hosts
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\2.hosts
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\3.hosts
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
Adware:Adware/PurityScan No disinfected C:\WINDOWS\SYSTEM32\RGEDIT~1.EXE


Logfile of HijackThis v1.99.1
Scan saved at 9:30:29 PM, on 6/23/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\FirstClass\Fcc32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\ewido\security suite\SecuritySuite.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Annie Easterly\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emory.webex....bex/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#6
loophole
Posted 23 June 2005 - 08:41 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hey jld4523 :tazz:

Most of the things the scanners were picking up were in temp. folders. Below is an excellent tool for cleaning them out.

download and install CleanUp! but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
C:\WINDOWS\SYSTEM32\RGEDIT~1.EXE<<<<< Please do not delete REGIDIT.EXE
C:\WINDOWS\sepsd.bin

Please run Cleanup

Reboot and post a Hijack log. How is your computer running now?
  • 0

#7
jld4523
Posted 24 June 2005 - 07:54 AM

jld4523

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
below is the log of the Hijack This scan. I did not find the files that you listed. The computer seems to still be running slow, but I guess time will tell.

Logfile of HijackThis v1.99.1
Scan saved at 9:49:07 AM, on 6/24/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Annie Easterly\Desktop\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://emory.webex....bex/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#8
loophole
Posted 24 June 2005 - 12:26 PM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
:tazz:

Your log is clean. Uninstall Ewido,that may help. You dont have many optionals that would speed your computer up. Is it running slower than it has been?
  • 0

#9
loophole
Posted 09 July 2005 - 05:18 AM

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP