Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Aurora.exe and DrPMon.dll


  • Please log in to reply

#1
tweets32

tweets32

    New Member

  • Member
  • Pip
  • 2 posts
My virus program keeps finding the Aurora Ad Agent virus and the DrPMon.dll on my computer (and possibly more). When I delete them, they come right back. Aurora keeps putting the virus in different temp folders and the DrPMon.dll keeps magically reappearing. My virus protector is Avast. I have run both Ad Aware and Spybot S&D already. I got the viruses originally because I made the mistake of turning off my popup protector so that I could listen to the radio online. I got so many viruses in that short time that I'll never do that again. The popup protector is turned back on. Please note that I also have a program called Cybersitter that restricts internet access for settings that I control.

Here is my log.

Logfile of HijackThis v1.99.1
Scan saved at 4:38:16 PM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\Cyb2k.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
c:\windows\system32\huvquwb.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Maurice\My Documents\Robin Documents\My Received Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 12.127.16.68 internet_dns_primary # internet domain name server
O1 - Hosts: 12.127.17.72 internet_dns_backup # internet domain name server
O1 - Hosts: 12.153.49.1 cisco_router
O1 - Hosts: 12.153.49.2 nightsun_ext nightsun_ext.data-sci.com
O1 - Hosts: 12.153.49.33 nightsun_dmz nightsun_dmz.data-sci.com
O1 - Hosts: 207.32.117.129 nightsun_lan nightsun_lan.data-sci.com
O1 - Hosts: 12.153.49.5 dsivpn_ext dsivpn_ext.data-sci.com
O1 - Hosts: 207.32.117.207 dsivpn_lan dsivpn_lan.data-sci.com
O1 - Hosts: 12.153.49.4 sylvester sylvester.data-sci.com # emergency dialup
O1 - Hosts: 12.153.49.34 mailserver mail.data-sci.com
O1 - Hosts: 12.153.49.35 webserver www.data-sci.com
O1 - Hosts: 12.153.49.36 ftpserver ftp.data-sci.com # access blocked from lan
O1 - Hosts: 207.32.117.194 scooby scooby.data-sci.com # lan access to ftpserver
O1 - Hosts: 207.32.117.130 fudd fudd.data-sci.com # linux slow modem share
O1 - Hosts: 207.32.117.149 goofy #goofy.data-sci.com
O1 - Hosts: 207.32.117.160 dialin1 # ras ip pool (dynamic)
O1 - Hosts: 207.32.117.161 dialin2 # ras ip pool (dynamic)
O1 - Hosts: 207.32.117.162 dialin3
O1 - Hosts: 207.32.117.163 dialin4
O1 - Hosts: 207.32.117.164 dialin5
O1 - Hosts: 207.32.117.156 robinf #robinf
O1 - Hosts: 207.32.117.172 support_vpn #digitalpc5000
O1 - Hosts: 207.32.117.177 taz taz.data-sci.com #
O1 - Hosts: 207.32.117.178 ntdevl ntdevl.data-sci.com # ntdevl
O1 - Hosts: 207.32.117.179 free179 #notebook4 notebook4.data-sci.com # dell #2
O1 - Hosts: 207.32.117.180 hplj5 hplj5.data-sci.com # hplj5
O1 - Hosts: 207.32.117.181 tiprint tiprint.data-sci.com # ti8920
O1 - Hosts: 207.32.117.182 vwin98elinux
O1 - Hosts: 207.32.117.183 dsimp dsimp.data-sci.com # dec 433mp / sco 5
O1 - Hosts: 207.32.117.184 xerox xerox.data-sci.com
O1 - Hosts: 207.32.117.186 dsidec dsidec.data-sci.com # dec 433mp / sco
O1 - Hosts: 207.32.117.188 dsipent dsipent.data-sci.com # decpc xl server 590 / sco
O1 - Hosts: 207.32.117.189 hplj4 hplj4.data-sci.com # hp laserjet 4 w/jet direct
O1 - Hosts: 207.32.117.190 dopey dopey.data-sci.com # pentium / nt server
O1 - Hosts: 207.32.117.191 pluto pluto.data-sci.com # pluto
O1 - Hosts: 207.32.117.192 dsiunxw7 dsiunxw7.data-sci.com # dec unixware 7 server
O1 - Hosts: 207.32.117.193 happy # poweredge 6400
O1 - Hosts: 207.32.117.194 scooby scooby.data-sci.com # linux isdn server
O1 - Hosts: 207.32.117.195 roadrunner roadrunner.data-sci.com # linux communications server
O1 - Hosts: 207.32.117.196 qpdell
O1 - Hosts: 207.32.117.197 qpnt4vir
O1 - Hosts: 207.32.117.207 vpntest
O1 - Hosts: 207.32.117.231 ppp-in1 ppp-in1.data-sci.com # roadrunner dialin ppp
O1 - Hosts: 207.32.117.232 ppp-in2 ppp-in2.data-sci.com # roadrunner dialin ppp
O1 - Hosts: 207.32.117.233 ppp-in3 ppp-in3.data-sci.com # roadrunner dialin ppp
O1 - Hosts: 207.32.117.234 ppp-in4 ppp-in4.data-sci.com # roadrunner dialin ppp
O1 - Hosts: 207.32.117.235 ppp-in5 ppp-in5.data-sci.com # roadrunner dialin ppp
O1 - Hosts: 207.32.117.236 vpn-in1 vpn-in1.data-sci.com # vpn via dsivpn
O1 - Hosts: 207.32.117.237 vpn-in2 vpn-in2.data-sci.com # vpn via dsivpn
O1 - Hosts: 207.32.117.238 vpn-in3 vpn-in3.data-sci.com # vpn via dsivpn
O1 - Hosts: 207.32.117.239 vpn-in4 vpn-in4.data-sci.com # vpn via dsivpn
O1 - Hosts: 207.32.117.240 vpn-in5 vpn-in5.data-sci.com # vpn via nightsun
O1 - Hosts: 207.32.117.241 vpn-in6 vpn-in6.data-sci.com # vpn via nightsun
O1 - Hosts: 207.32.117.242 vpn-in7 vpn-in7.data-sci.com # vpn via nightsun
O1 - Hosts: 207.32.117.243 vpn-in8 vpn-in8.data-sci.com # vpn via nightsun
O1 - Hosts: 207.32.117.244 vpn-in9 vpn-in9.data-sci.com # vpn via nightsun
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\Cyb2k.exe
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [ecsagp] c:\windows\system32\huvquwb.exe r
O4 - HKCU\..\Run: [ESPN BottomLine] C:\Program Files\ESPN\BottomLine\bline.exe
O4 - HKCU\..\Run: [seticlient] C:\Program Files\SETI@home\SETI@home.exe -min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\RunOnce: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /play
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: axscanner - http://www.pestscan....r/axscanner.cab
O16 - DPF: axscannerruntime - http://www.pestscan....nnerruntime.cab
O16 - DPF: mscomctl - http://www.pestscan....er/mscomctl.cab
O16 - DPF: msvcp71 - http://download.pest...nts/msvcp71.cab
O16 - DPF: msvcr71 - http://download.pest...nts/msvcr71.cab
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {20048BB3-DB68-11CF-9CAF-00AA006CB425} (007installer Control) - http://download.007g...abs/maycomb.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...s/yinst0401.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1096284842824
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installen...gine/isetup.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E4961D20-6367-4C75-BCF3-5213C29A827C} (llamapro) - https://www.pimpwar....ro/llamapro.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.c...ebio5_0_2_1.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  • 0

Advertisements


#2
therock247uk

therock247uk

    Expert

  • Expert
  • 14,671 posts
  • MVP
Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
  • 0

#3
tweets32

tweets32

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
I could not do what you said because I could not get Nailfix to unzip. I tried downloading it 3 times. I also tried unzipping it using WinZip and WinRAR. Both programs tell me that the archive is in unknown format or damaged.
  • 0

#4
therock247uk

therock247uk

    Expert

  • Expert
  • 14,671 posts
  • MVP
Ok skip that part.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP