Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Malware Cannot Be Cleaned [RESOLVED]

Started by KathyHolle , Jun 18 2005 03:23 PM

This topic is locked

#16
Guest_usetobe_*

Posted 29 June 2005 - 04:09 AM

Guest

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #4 for Run Fix by typing 4 and then pressing enter. This will restore the winlogon defaults.

Then boot into Safe mode by tapping the F8 KEY whilst pc starts up, select safe mode option.

Scan with Ewido again and save the log.

Scan with HJT and check the following entries if they still exist:

O20 - Winlogon Notify: URL - C:\WINDOWS\system32\i0240afqed2e0.dll (file missing)

Ensure no windows open and click fix checked.

Reboot pc normally, rescan with Panda Active from previous link and save the report

Rescan with HJT and post the log back with the ewido and panda scans

#17
KathyHolle

Posted 29 June 2005 - 08:32 AM

Member

Topic Starter
Member
24 posts

This line is still there in HJT:
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia...ll/pcs_0026.exe

pacmedia shows up in my windows task manager when pop-ups are there.

Should I delete it?

#18
KathyHolle

Posted 29 June 2005 - 08:33 AM

Member

Topic Starter
Member
24 posts

Logfile of HijackThis v1.99.1
Scan saved at 10:12:03 AM, on 6/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cheapskatemonthly.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cheapskatemonthly.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bgnl1wjo.slt\prefs.js)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.eservice.net
O15 - Trusted Zone: *.esylvan.com
O16 - DPF: Yahoo! Chat - http://cs5.chat.sc5....m/c381/chat.cab
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://www.comcastsu...ad/tgctlins.cab
O16 - DPF: {25881AEA-B5CF-48C2-A871-17A6078891C6} (VoiceTech (Firewall) Voice Control Push Browser) - https://www.voicenow...eway/hmvcfe.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com...stall/AxCtp.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.googl...g/GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.c...ient/isetup.cab
O16 - DPF: {970EF5A2-CE21-4A16-B21F-3FC9AF1F89F2} (HearMe (eSylvan) (Firewall) Voice Control) - http://techsupport.e...itor/esvcfe.cab
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia...ll/pcs_0026.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {A018C3AE-D60B-42C6-B8F1-CD1E97166BE3} (MixerCtrl Control) - http://teacher1.esyl...m/MixerCtrl.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart...ploadClient.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://livenj01.righ...l/java/RntX.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.c...bio4_0_2_10.cab
O16 - DPF: {FFA0B580-F85C-11D4-B501-00010261BA08} - http://www1.esylvana....com/PCInfo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F050488B-C9E6-4900-8918-DB546B56AAA3}: NameServer = 192.168.0.1
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\i0240afqed2e0.dll (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

#19
KathyHolle

Posted 29 June 2005 - 08:35 AM

Member

Topic Starter
Member
24 posts

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:11:09 AM, 6/29/2005
+ Report-Checksum: 6D09D08D

+ Date of database: 6/29/2005
+ Version of scan engine: v3.0

+ Duration: 122 min
+ Scanned Files: 164122
+ Speed: 22.41 Files/Second
+ Infected files: 6
+ Removed files: 6
+ Files put in quarantine: 6
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\WINDOWS\Temp\Cookies\owner@abcsearch[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\Temp\Cookies\[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@overture[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\Temp\Cookies\[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\Temp\Cookies\[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\WINDOWS\Temp\Cookies\owner@zedo[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup

::Report End

#20
Guest_usetobe_*

Posted 29 June 2005 - 08:35 AM

Guest

New panda scan?

#21
KathyHolle

Posted 29 June 2005 - 08:45 AM

Member

Topic Starter
Member
24 posts

It's scanning now. Takes a while! So far, it's found 13 infected files.

By the way, my computer is running WONDERFULLY now! No pop-ups, so far.

I'll post when it's done.

#22
KathyHolle

Posted 29 June 2005 - 11:30 AM

Member

Topic Starter
Member
24 posts

Incident Status Location

Adware:Adware/eZula No disinfected Windows Registry
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\unstall.exe
Adware:Adware/CWS No disinfected C:\Documents and Settings\Owner\Favorites\Health
Adware:Adware/Apropos No disinfected Windows Registry
Adware:Adware/WinTools No disinfected C:\WINDOWS\hisistheurls.exe
Adware:Adware/DelFinMedia No disinfected Windows Registry
Adware:Adware/SideStep No disinfected C:\Documents and Settings\Owner\Start Menu\Programs\SideStep
Adware:Adware/WUpd No disinfected C:\Program Files\Media Access
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Owner\Favorites\Casino & Carrers
Spyware:Spyware/SurfSideKick No disinfected Windows Registry
Adware:Adware/ImGiant No disinfected C:\Program Files\joystick networks
Adware:Adware/BigTrafficNet No disinfected Windows Registry
Adware:Adware/Weirdontheweb No disinfected C:\Documents and Settings\Owner\Favorites\WeirdOnTheWeb.url
Adware:Adware/Apropos No disinfected C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\AlertSWF\contents\Exec.exe
Adware:Adware/SideStep No disinfected C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\SideStep.lnk
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[dacdll.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[DCrtSnmp2.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[DLrtSnmp.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[dnp6017se.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[FE10.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[fiusd.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[g2lmlc311f.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[gidef.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[hgetcfg.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[iertprio.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[irnul5591.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[iyircl.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[izfxpph.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[khrnel32.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[kt8sl7l71.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[kxdsf.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[Lrkrn12n.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[maexcl40.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[oqmanage.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[p28q0cl5efq.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[ppustab.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[SXP32.DLL]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[weashext.dll]
Adware:Adware/SideStep No disinfected C:\Documents and Settings\Owner\Favorites\Links\SideStep.url
Adware:Adware/SideStep No disinfected C:\Documents and Settings\Owner\Favorites\SideStep.url
Adware:Adware/Weirdontheweb No disinfected C:\Documents and Settings\Owner\Favorites\WeirdOnTheWeb.url
Spyware:Spyware/Media-motor No disinfected C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\0155677A-5671-4A14-B94A-3FF9E6.asq
Adware:Adware/AdBehavior No disinfected C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\FC08DA1F-9044-42DD-B162-5999B8.asq
Spyware:Spyware/BargainBuddy No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\0580E218-7981-4E75-8540-A71DD5
Spyware:Spyware/BargainBuddy No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\3B33463A-EA3D-4D43-A8E3-838C8F
Spyware:Spyware/BargainBuddy No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\4A61C279-A160-47C8-A1AA-7909DF
Spyware:Spyware/BargainBuddy No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\AF5A4BE1-BE62-4F2C-B805-6D4B5B
Spyware:Spyware/BargainBuddy No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\DB00802F-470C-49D8-9C90-FD4DA8
Adware:Adware/AdDestroyer No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\92EF5956-AE76-43E0-9E6E-1F7F83\E5AF3CCC-4173-49B0-9DAA-9B3F1F
Adware:Adware/SideStep No disinfected C:\WINDOWS\Downloaded Program Files\SbCIe01f.inf
Adware:Adware/SideStep No disinfected C:\WINDOWS\Downloaded Program Files\SbCIe026.dll
Adware:Adware/SideStep No disinfected C:\WINDOWS\Downloaded Program Files\SbCIe026.inf
Adware:Adware/WinTools No disinfected C:\WINDOWS\hisistheurls.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\lzlmnu.exe
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\SYSTEM\QBUninstaller.exe
Virus:Trj/Qhost.Y Disinfected C:\WINDOWS\SYSTEM32\drivers\etc\hosts
Adware:Adware/AdBehavior No disinfected C:\WINDOWS\SYSTEM32\pgvyk.dat
Adware:Adware/AdBehavior No disinfected C:\WINDOWS\SYSTEM32\rlmupk.exe
Adware:Adware/AdBehavior No disinfected C:\WINDOWS\SYSTEM32\ryuciek.dll
Adware:Adware/AdBehavior No disinfected C:\WINDOWS\SYSTEM32\ugnvs.dll
Adware:Adware/AdBehavior No disinfected C:\WINDOWS\SYSTEM32\vlnapr.exe
Spyware:Spyware/Media-motor No disinfected C:\WINDOWS\unstall.exe

#23
Guest_usetobe_*

Posted 30 June 2005 - 03:46 AM

Guest

Copy the filepaths below into notepad

C:\WINDOWS\unstall.exe
C:\Documents and Settings\Owner\Favorites\Health
C:\WINDOWS\hisistheurls.exe
C:\Documents and Settings\Owner\Start Menu\Programs\SideStep
C:\Program Files\Media Access
C:\Documents and Settings\Owner\Favorites\Casino & Carrers
C:\Program Files\joystick networks
C:\Documents and Settings\Owner\Favorites\WeirdOnTheWeb.url
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\AlertSWF\contents\Exec.exe
C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\SideStep.lnk
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[dacdll.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[DCrtSnmp2.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[DLrtSnmp.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[dnp6017se.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[FE10.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[fiusd.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[g2lmlc311f.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[gidef.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[hgetcfg.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[iertprio.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[irnul5591.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[iyircl.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[izfxpph.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[khrnel32.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[kt8sl7l71.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[kxdsf.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[Lrkrn12n.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[maexcl40.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[oqmanage.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[p28q0cl5efq.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[ppustab.dll]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[SXP32.DLL]
C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip[weashext.dll]
C:\Documents and Settings\Owner\Favorites\Links\SideStep.url
C:\Documents and Settings\Owner\Favorites\SideStep.url
C:\Documents and Settings\Owner\Favorites\WeirdOnTheWeb.url
C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\0155677A-5671-4A14-B94A-3FF9E6.asq
C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\FC08DA1F-9044-42DD-B162-5999B8.asq
C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\0580E218-7981-4E75-8540-A71DD5
C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\3B33463A-EA3D-4D43-A8E3-838C8F
C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\4A61C279-A160-47C8-A1AA-7909DF
C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\AF5A4BE1-BE62-4F2C-B805-6D4B5B
C:\Program Files\Microsoft AntiSpyware\Quarantine\3A33C5E1-5F3E-4E8F-8750-6FA64A\DB00802F-470C-49D8-9C90-FD4DA8
C:\Program Files\Microsoft AntiSpyware\Quarantine\92EF5956-AE76-43E0-9E6E-1F7F83\E5AF3CCC-4173-49B0-9DAA-9B3F1F
C:\WINDOWS\Downloaded Program Files\SbCIe01f.inf
C:\WINDOWS\Downloaded Program files\SbCIe026.dll
C:\WINDOWS\Downloaded Program Files\SbCIe026.inf
C:\WINDOWS\hisistheurls.exe
C:\WINDOWS\lzlmnu.exe
C:\WINDOWS\SYSTEM\QBUninstaller.exe
C:\WINDOWS\SYSTEM32\pgvyk.dat
C:\WINDOWS\SYSTEM32\rlmupk.exe
C:\WINDOWS\SYSTEM32\ryuciek.dll
C:\WINDOWS\SYSTEM32\ugnvs.dll
C:\WINDOWS\SYSTEM32\vlnapr.exe
C:\WINDOWS\unstall.exe

* Please download the http://www.bleepingc...es/killbox.php]Killbox by Option^Explicit[/url]. *In the event you already have Killbox, this is a new version that I need you to download.

* Save it to your desktop.

* Please double-click Killbox.exe to run it.

* Select "Delete on Reboot".

* Open the Notepad file where you saved the file paths earlier and copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C

* Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

* Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually. Whilst pc is rebooting tap the F8 key to go to SAFE MODE.

Rescan with HJT and check the following entries if present

O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia...ll/pcs_0026.exe
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\i0240afqed2e0.dll (file missing)

Reboot normally, rescan with HJT and post the log back

#24
KathyHolle

Posted 30 June 2005 - 10:34 AM

Member

Topic Starter
Member
24 posts

Logfile of HijackThis v1.99.1
Scan saved at 12:32:53 PM, on 6/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME\Binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\PROGRA~1\NORTON~2\navapw32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cheapskatemonthly.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cheapskatemonthly.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\bgnl1wjo.slt\prefs.js)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\navapw32.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.eservice.net
O15 - Trusted Zone: *.esylvan.com
O16 - DPF: Yahoo! Chat - http://cs5.chat.sc5....m/c381/chat.cab
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://www.comcastsu...ad/tgctlins.cab
O16 - DPF: {25881AEA-B5CF-48C2-A871-17A6078891C6} (VoiceTech (Firewall) Voice Control Push Browser) - https://www.voicenow...eway/hmvcfe.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com...stall/AxCtp.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.googl...g/GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.c...ient/isetup.cab
O16 - DPF: {970EF5A2-CE21-4A16-B21F-3FC9AF1F89F2} (HearMe (eSylvan) (Firewall) Voice Control) - http://techsupport.e...itor/esvcfe.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {A018C3AE-D60B-42C6-B8F1-CD1E97166BE3} (MixerCtrl Control) - http://teacher1.esyl...m/MixerCtrl.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart...ploadClient.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://livenj01.righ...l/java/RntX.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.c...bio4_0_2_10.cab
O16 - DPF: {FFA0B580-F85C-11D4-B501-00010261BA08} - http://www1.esylvana....com/PCInfo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F050488B-C9E6-4900-8918-DB546B56AAA3}: NameServer = 192.168.0.1
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

#25
KathyHolle

Posted 30 June 2005 - 10:37 AM

Member

Topic Starter
Member
24 posts

I noticed THIS in the list:
C:\WINDOWS\system32\wuauclt.exe

Isn't that malware?

#26
Guest_usetobe_*

Posted 30 June 2005 - 10:42 AM

Guest

Windows Update AutoUpdate Client. Background process which checks with Microsoft website for updates to the operating system. Shows up on the Task Manager's processes list when it is waiting for a response, e.g. to confirm permission to download an update.

Note: The wuauclt.exe file is located in the c:\windows\System32 folder. In other cases, wuauclt.exe is a virus, spyware, trojan or worm!

Yours is good!

From your log, I see nothing in the ways of trojans, nor any evil entities attempting to possess your computer, except for Windows but it's too late for that one. :tazz:

Congratulations your log now appears to be clean.

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:

How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

Prevention Programs:

Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar <= Get the free google toolbar to help stop pop up windows.

Other necessary Programs:

AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
Firewall<= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
More Secure Browser<= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox, however Opera and SlimBrowsers are good as well.

And also see TonyKlein's good advice
So how did I get infected in the first place? and AntiSpyware Net's spyware article: Spyware, Adware, Malware: What it is, how it got on my computer, how to get rid of it, and how to prevent it.

#27
KathyHolle

Posted 30 June 2005 - 10:46 AM

Member

Topic Starter
Member
24 posts

Thank you!

You will definitely be getting a donation from me after pay day next week!

#28
Guest_usetobe_*

Posted 30 June 2005 - 10:48 AM

Guest

You're very welcome glad to be of assistance to you.

Happy, Safe Surfing

#29
Guest_usetobe_*

Posted 12 July 2005 - 01:05 AM

Guest

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.