[TheSteveSteve]

Hey guys! Another aurora problem. What a crappy program. I am ready to tackle this full force. Thanks again for all the help.

steve

Logfile of HijackThis v1.99.1
Scan saved at 10:01:27 AM, on 6/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\System32\slbiop.exe
c:\windows\system32\qdvegtn.exe
C:\Program Files\RoamAbout\CMrbt.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\hijack\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [xbwxwfy] c:\windows\system32\qdvegtn.exe
O4 - HKCU\..\Run: [slbiop] C:\WINDOWS\System32\slbiop.exe
O4 - Global Startup: RoamAbout Client Manager.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1114912179342
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe


unistall log


Adobe Reader 6.0.1
AOL Instant Messenger
CCleaner (remove only)
Display Utility
HijackThis 1.99.1
Microsoft Data Access Components KB870669
Microsoft Office 2000 SR-1 Standard
Mozilla Firefox (1.0.4)
QuickTime
RoamAbout
RoamAbout Client Manager V3.30
The ABI Network- A Division of Direct Revenue
Viewpoint Media Player
VX2 Cleaner plug-in for Ad-Aware SE
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2

[Advertisements]

Hi Steve,

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Reboot the PC.

Please do an online scan at Kasperskyand save the log file.

Run Hijack This and post a fresh HJT log along with Ewido and Kaspersky logs.

[tampabelle]

Hi Steve,

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Reboot the PC.

Please do an online scan at Kasperskyand save the log file.

Run Hijack This and post a fresh HJT log along with Ewido and Kaspersky logs.

[TheSteveSteve]

Logfile of HijackThis v1.99.1
Scan saved at 10:51:39 PM, on 6/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\RoamAbout\CMrbt.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\hijack\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKCU\..\Run: [slbiop] C:\WINDOWS\System32\slbiop.exe
O4 - Global Startup: RoamAbout Client Manager.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1114912179342
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe

KASPER Log
-------------------------------------------------------------------------------
KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Thursday, June 23, 2005 22:50:19
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 24/06/2005
Kaspersky Anti-Virus database records: 127528
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\

Scan Statistics:
Total number of scanned objects: 20642
Number of viruses found: 6
Number of infected objects: 33
Number of suspicious objects: 0
Duration of the scan process: 2553 sec

Infected Object Name - Virus Name
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP85\A0009795.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP85\A0009818.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP89\A0009864.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP89\A0009866.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP91\A0009918.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP91\A0009923.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP91\A0009932.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP91\A0009934.exe Infected: Trojan-Downloader.Win32.Agent.am
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP92\A0009960.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP92\A0009972.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0009994.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0009995.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010005.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010015.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010022.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010044.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010053.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010101.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010105.exe Infected: Trojan.Win32.Stervis.c
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010122.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010130.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010142.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010147.exe Infected: Trojan.Win32.Stervis.c
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010161.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010175.exe Infected: Trojan.Win32.Stervis.c
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010182.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010196.exe Infected: Trojan.Win32.Agent.cp
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010209.exe Infected: Trojan-Downloader.Win32.Delmed.b
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010210.exe Infected: Trojan-Downloader.Win32.Agent.am
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010213.dll Infected: Trojan.Win32.Agent.db
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010220.exe Infected: Trojan.Win32.Stervis.c
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010223.exe Infected: Trojan-Dropper.Win32.SurfSide.a
C:\System Volume Information\_restore{A53891FD-9768-409C-B66D-DAA8CCDAD43A}\RP95\A0010226.exe Infected: Trojan.Win32.Agent.cp

Scan process completed.


Ewido Log
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:31:58 PM, 6/23/2005
+ Report-Checksum: EBDEEE57

+ Date of database: 6/24/2005
+ Version of scan engine: v3.0

+ Duration: 33 min
+ Scanned Files: 28340
+ Speed: 14.30 Files/Second
+ Infected files: 14
+ Removed files: 14
+ Files put in quarantine: 14
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\Documents and Settings\Steve\Cookies\[email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\steve@advertising[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\steve@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\steve@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\steve@tribalfusion[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Steve\Cookies\[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe -> Spyware.DelphinMedia.Viewer.f -> Cleaned with backup
C:\WINDOWS\fvcwldkheh.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\WINDOWS\sskb5.exe -> TrojanDropper.SurfSide.a -> Cleaned with backup
C:\WINDOWS\system32\nsvsvc\nsv.ocx -> Spyware.DelphinMediaViewer.c -> Cleaned with backup
C:\WINDOWS\system32\nsvsvc\nsvs.dll -> Spyware.DelphinMedia.f -> Cleaned with backup
C:\WINDOWS\system32\nxguced.exe -> Trojan.Agent.cp -> Cleaned with backup


::Report End


steve

[tampabelle]

Hi Steve,

There a couple of issues still to be dealt with !!!

I would say that you are either very brave and foolhardy or totally ignorant !!! You donot have any security measure implemented on your PC, apart from Ewido which you downloaded for this fix !!!!!!

Lets get that aspect fixed so that your PC is not infected immediately.

Anti-Virus Software
1. Keep your Anti-virus program updated with the latest definitions. Some of the common anti-virus programs in use are (both are freeware for personal use):

AVG Anti-Virus
Avast Home Edition

Use only one anti-virus program as multiple such programs can create conflicts between themselves and severely hamper the performance of your PC.


Firewall
2. You should also have a good firewall. Here are 3 free ones available for personal use:
Sygate Personal Firewall, Kerio Personal Firewall, ZoneAlarm


Spyware Protection
3. Have a wall of protection against spyware / adware by installing SpywareBlaster and SpywareGuard.

SpywareBlaster and SpywareGuard are by JavaCool and both are free programs.
SpywareBlaster will prevent spyware from being installed and consumes no system resources.
SpywareGuard offers realtime protection from spyware installation and browser hijack attempts. Both have free ongoing updates.


Spyware Removers
4. Install programs for scanning for malware and uninstalling them. Two of the best programs, both are freeware, are :

Spybot Search & Destroy - A powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

AdAware SE Personal Edition - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.



Of course you can purchase a lot of stuff, but these are some of the best programs around and are free to boot. Please install them.

Reboot the PC and post a fresh Hijack This log. Also tell me how your PC is behaving

[TheSteveSteve]

I have installed nortons 2002 and am ready to defend my computer. I now know why I had a virus installed. Thanks for your help and hope all is well on your end.

s
t
e
v
e

[tampabelle]

Hi Steve,

there a couple of small things to be cleaned up.

Run Hijack This and click on Scan. Check the box next to following item and click on Fix checked.

O4 - HKCU\..\Run: [slbiop] C:\WINDOWS\System32\slbiop.exe


Reboot the PC in Safe Mode.

Locate and delete the following files -

C:\WINDOWS\fvcwldkheh.exe
C:\WINDOWS\sskb5.exe

C:\WINDOWS\System32\slbiop.exe
C:\WINDOWS\system32\nsvsvc\nsv.ocx
C:\WINDOWS\system32\nsvsvc\nsvs.dll
C:\WINDOWS\system32\nxguced.exe

Reboot the PC and post a fresh HJT log.

[tampabelle]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.