[j-alexander]

First please see http://www.geekstogo...udc-t31208.html and the rest will make sense - this is a log from a pc infected by the smitfraud.c Trojan Spy.

Here's the second log (XP Home laptop):

Logfile of HijackThis v1.99.1
Scan saved at 11:53:53, on 02/06/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\wp.exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\john stephen\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell...gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=2346
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=2346
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765728274} - C:\WINDOWS\System32\wer8274.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: ubisoft register.lnk = C:\Program Files\Ubi Soft\Register\schedule.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O8 - Extra context menu item: &Search - http://bar.mywebsear...GB_ZSzeb029AXGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Microsoft AntiSpyware helper - {EAFF285E-A890-441D-A5D3-75C00E48649D} - (no file)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EAFF285E-A890-441D-A5D3-75C00E48649D} - (no file)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {00203AA7-BCC8-4009-9716-6509F28DA918} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {00203AA7-BCC8-4009-9716-6509F28DA918} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {14771B69-2503-4BE3-9014-CAC285AC3B4B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {14771B69-2503-4BE3-9014-CAC285AC3B4B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EAFF285E-A890-441D-A5D3-75C00E48649D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EAFF285E-A890-441D-A5D3-75C00E48649D} - (no file) (HKCU)
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:\nosuch.mht!http://www.awmdabest....chm::/file.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...up1.0.0.8-2.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F920A57-5116-4CEB-8C93-46AB3A2D429F}: NameServer = 194.168.4.100,194.168.8.100
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Navnt\npssvc.exe



Thanks,

John

[Advertisements]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

[coachwife6]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

[j-alexander]

Thanks - I'll update that now - will take a few minutes.

[j-alexander]

Have updated the xp operating system up to service pack 2 (that was the only option that came up). Now it seems to be on a constantly restarting loop - cant seem to draw it out of it - any suggestions?

Thanks,

J-alexander

[coachwife6]

It's not a good idea to update to sp2 until you're clean. I'll tackle this one first. Give me a new log and then we'll go from there.

[j-alexander]

I did try and create a new hijackthis log on the xp system. But I have a more urgent problem with it now - since sp2 has been installed (i couldnt find sp1 on microsofts automatic update site - that thing is really cumbersome). So now it doesnt even get as far as the desktop. As soon as the loading windows screen comes up it loads for a bit and then just as it would normally go to desktop it continues on a loop of restarting. I have tried to restart in safe mode (normal safe mode, safe mode with networking and safe mode in MS-DOS) but that doesnt work. The other option (to restart in the last working configuration) doesnt work either. Any suggestions? (I'd rather leave myself open to re-infection on the xp system till its fixed so it can be fully update it rather than trying to get sp1 and continuing this never-ending loop).

Thanks a lot again for the help on the 98 system, I fear that this one is a bit worse tho

J-alexander

[coachwife6]

Can you reset your restore points to when it was working properly or before you updated to sp2?

How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb;en-us;310405

[j-alexander]

Can you reset your restore points to when it was working properly or before you updated to sp2?

How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb;en-us;310405

Resetting restore points is something I've never attempted before. I have tried to change what I could (e.g. trying to boot from different sources) but I still cant actually get to the desktop to change anything meaningful (I can't even get into MS-DOS to do it the old-fashioned way).

I have tried to look for the on and off system restore in windows XP in that link you gave me, but the Microsoft site is one of the most confusing sites I've ever logged onto. It's not that there isn't a lot of useful stuff there, its that there's too much. I can never do anything through the Microsoft site (as is seen by the mistake on updating to sp2). So im going to be a pain and ask if you could give the instructions on here or on a link to microsoft that doesn't have too many things to choose from (cause I'll just get it wrong ).

J-alexander


UPDATE: for once I did actually manage to find the correct part of the site. But it seems that I cant do that (log on as administrator etc etc...) as I cant get past the "Microsoft Windows" with the little loading bar with the blue blocks scrolling past - all that happens is a gigantic loop begins. Its looking a bit like a total system overhall (formatting c:\) may be the only answer for this one.

Thanks,

J-alexander

Edited by j-alexander, 26 June 2005 - 08:17 AM.

[coachwife6]

Have you tried rebooting into safe mode?

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

[j-alexander]

Have you tried rebooting into safe mode?

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

I have tried that before ... but will try again tomorrow. Will be busy at work untill tomorrow night so it may be tuesday night (GMT) before you get a reply to this thread.

J-alexander

[coachwife6]

I'll do some checking around for you. Don't sweat it. We'll get it fixed.

[coachwife6]

How is it going?

[j-alexander]

How is it going?

Sorry about that - I've been snowed under with work - but finished now.

I've tried to start it in all different kinds of mode - it almost worked under the administrator recovery mode (it had some other name I can't remember).

But safe mode (and virtually all other modes - didnt have time to try them all) didn't work.

There is a piece of code which comes up - looks like a file location - showing the file/component of sp2 which is causing the problem. Not sure what to do with it now.
Any suggestions welcome!

J-alexander

[coachwife6]

Do you have your windows xp disc?

[j-alexander]

Do you have your windows xp disc?

Yeah - I think I know where it is - should be able to find it in a few minutes of looking.