[chrisjonas]

Hi

I recently had difficulty removing SpySheriff but followed your advice before posting a log. I no longer have it appearing everytime i log in but i now am unable to use certain applications such as Windows Media Player when i try to burn cds.

The message reads: C00D11CD: Unknown error
Windows Media Player encountered an unknown error. This can occur when another program or operating system component encounters a problem but does not communicate the nature of the problem to Windows Media Player.

Even installing Norton Anti-Virus 2005 has proved impossible. 99% of it installs but it fails to install the last few files each time no matter how many times i retry.
I don't know if these problems are related to my malware problems and require a different solution. I would appreciate some help to remedy this.

The programs i have utilised are:

CleanUp!
Ad-aware SE
CW Shredder
Spybot S&D
Ewido Security Suite
HijackThis

I should also say i am running AVG in the absence of Norton Anti-Virus.

I tried to run an online scan, but Trend Housecall would not run and Panda ActiveScan would not for some reason complete its scan. This is despite it finding infected files. It closes half way through the scan without warning or explanation. I tried to run it three times with the same outcome.

Here are the logs you request:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 16:11:34, 25/07/2005
+ Report-Checksum: 702CFA3D

+ Scan result:

:mozilla.7:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.8:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.9:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.10:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.11:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.12:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.21:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.22:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.23:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.24:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.36:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.37:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.38:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.39:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.48:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.49:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.53:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.54:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.62:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.64:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.65:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.66:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.79:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.80:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.102:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.103:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.104:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.105:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.120:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.121:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.144:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.145:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.150:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.151:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.152:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.153:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
D:\Program Files\Incomplete\Preview-T-872159-Norton AntiVirus 2005 Pro.zip/Setup.exe -> Worm.VB.an : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 19:00:47, on 25/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\ewido\security suite\ewidoguard.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\Explorer.EXE
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\RunDll32.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Windows Media Player\wmplayer.exe
D:\WINDOWS\system32\imapi.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\SoftwareDistribution\Download\Install\873374_eng.exe
D:\DOCUME~1\-CHRIS~1.CHR\LOCALS~1\Temp\IXP000.TMP\msiutil2.exe
D:\WINDOWS\system32\msiexec.exe
D:\Documents and Settings\-Chris-.CHRIS\Desktop\Security\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = D:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122308645515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe

Thanks for your time and I await your instruction.

Chris

[Advertisements]

Welcome to Geeks to Go!. Sorry about the delay in getting to your post, we have been very busy.

Do you still require help or are your problems resolved?

Please let me know and if you still require assistance, please post a fresh HJT log.

Regards,

kool808

[kool808]

Welcome to Geeks to Go!. Sorry about the delay in getting to your post, we have been very busy.

Do you still require help or are your problems resolved?

Please let me know and if you still require assistance, please post a fresh HJT log.

Regards,

kool808

[chrisjonas]

Hi Kool808

Don't worry about the delay, I understand. Yes I am still having the same problems with installing Norton Antivirus and burning cds through Windows Media Player.

Here is a new log:

Logfile of HijackThis v1.99.1
Scan saved at 20:23:13, on 08/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\Explorer.EXE
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\WINDOWS\system32\RunDll32.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
D:\Documents and Settings\-Chris-.CHRIS\Desktop\Security\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = D:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122308645515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe

I'd really appreciate some help.

Thanks for your time.

Chris

[kool808]

Can you uninstall Norton Antivirus for a moment we will re-install it after this fix. We will do some diagnostics to determine where the problem comes from.

Please SAVE THIS PAGE or secure a PRINT COPY of the instructions for reference.
++++++++++++++++++++++++++++++++++++++++++++
Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.
Do NOT run it yet.

Place a shortcut to Panda ActiveScan on your desktop.

Please download the trial version of Ewido Security Suite 3.5 here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Do NOT run the scan yet!

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

(How to boot in Safe Mode...)
===================================================
Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:

• Click on scanner
• Click Complete System Scan and the scan will begin.
• During the scan it will prompt you to clean files, click OK
• When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop

Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked!

Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.
Let us know if any problems persist.

[chrisjonas]

Hi Kool808

Thanks for the advice. I followed your instructions and so here are the logs:

smitRem log file
version 2.3

by noahdfear

The current date is: 09/08/2005
The current time is: 20:05:18.06

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

CLEAN!



Incident Status Location

Spyware:spyware/istbar No disinfected D:\PROGRAM FILES\Daily Weather Forecast
Spyware:Spyware/ISTbar No disinfected D:\Documents and Settings\Administrator\Desktop\Daniel\cgu.exe
Spyware:Spyware/ISTbar No disinfected D:\Documents and Settings\Administrator\Desktop\Daniel\mirror_plugin.exe
Spyware:Spyware/ISTbar No disinfected D:\Documents and Settings\Administrator.CHRIS\Desktop\Daniel\cgu.exe
Spyware:Spyware/ISTbar No disinfected D:\Documents and Settings\Administrator.CHRIS\Desktop\Daniel\mirror_plugin.exe
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 21:14:59, 09/08/2005
+ Report-Checksum: 1E9F84CC

+ Scan result:

:mozilla.18:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup
:mozilla.29:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.37:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.42:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.43:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.44:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.45:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.46:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.47:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.48:D:\Documents and Settings\-Chris-.CHRIS\Application Data\Mozilla\Firefox\Profiles\sro2olbn.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.11:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.13:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.14:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.21:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.22:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.23:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.24:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.25:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.26:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup
:mozilla.27:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup
:mozilla.28:D:\Documents and Settings\-Pat-.CHRIS\Application Data\Mozilla\Firefox\Profiles\y7fppf7d.default\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup
:mozilla.23:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.33:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.77:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.78:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.91:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\an9l8obk.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup

Logfile of HijackThis v1.99.1
Scan saved at 22:45:13, on 09/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\Explorer.EXE
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\WINDOWS\system32\RunDll32.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\-Chris-.CHRIS\Desktop\Security\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = D:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122308645515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe

I will attempt to install Norton Antivirus and burn a cd tomorrow and then report to you if the problems persist.

Thanks for your time.
Chris

[kool808]

Good Job!

Please download http://securityresponse.symantec.com/avcenter/FxIstbar.exe. Save it to desktop then run it.

reboot in safe mode

Uninstall through add/remove programs:
Daily Weather Forecast

then delete these files/folders

D:\PROGRAM FILES\Daily Weather Forecast\ <-- whole folder
D:\Documents and Settings\Administrator\Desktop\Daniel\cgu.exe
D:\Documents and Settings\Administrator\Desktop\Daniel\mirror_plugin.exe
D:\Documents and Settings\Administrator.CHRIS\Desktop\Daniel\cgu.exe
D:\Documents and Settings\Administrator.CHRIS\Desktop\Daniel\mirror_plugin.exe

empty recycle bin.

reboot back in NORMAL MODE.

post a fresh hijackthis log and tell me how is everything running?

[chrisjonas]

Hi Kool808

Again I followed your instructions but I noticed the following:

The message 'Adware Istbar has not been found on your computer' came up after running the file.

Also I am still unable to install Nortoin Anti-Virus, it fails at the last, each time at the same point:

RB_versionControlBC731320_557D_4E8F_8CED_C...

Also I am still unable to burn cds using Windows Media Player, with the same message coming up: Unknown Error. I might add that the problems with Media Player arose after a friend installed Nero (without my knowledge) and although I uninstalled it almost right away the problems have persisted.

Here is the new log:

Logfile of HijackThis v1.99.1
Scan saved at 09:42:39, on 11/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\Explorer.EXE
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\WINDOWS\system32\RunDll32.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
D:\WINDOWS\system32\msiexec.exe
D:\WINDOWS\system32\imapi.exe
D:\Program Files\Windows Media Player\wmplayer.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\Program Files\Grisoft\AVG Free\avgemc.exe
D:\Program Files\Grisoft\AVG Free\avgcc.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\-Chris-.CHRIS\Desktop\Security\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = D:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122308645515
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe


Any thoughts?

Many thanks
Chris

Edited by chrisjonas, 11 August 2005 - 03:06 AM.

[kool808]

hmm.... Let me see. I can see that you did install Grisoft AVG <-- this is an AntiVirus program, Symantec Norton AV <-- this is again another AV.

Both programs work really great, they offer good services. However, if two AV programs are installed and running in your system at the same time they cause conflict to each other. At any circumstances errors arise. You must decide which to AV to keep.

With regard to Windows Media Player, do this:
Insert the Win XP CD to the CD-ROM drive
START > RUN > sfc > click the start button to replace all corrupted files.

You need to update to the latest patches for your Windows Update.

If this does not resolve the WMP problem then you need to re-install it again.

Your hijackthis log looks great, it is clean!

Edited by kool808, 11 August 2005 - 04:25 AM.

[chrisjonas]

Hi

Managed to fix Windows Media Player. Thanks for that. Still no luck with Norton AV though. I may just stick with AVG if nothing can be done.

Everything else is running smoothly.

Thank you very much.

Chris

[kool808]

Congratulations! your system is CLEAN!

WinXP Reset & All-Clean1

We have a couple of last steps to perform and then you're all set.

First, let's reset your hidden/system files and folders. System files are hidden for a reason and we don't want to have them openly available and susceptible to accidental deletion.* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View tab.
* Under the Hidden files and folders heading UNSELECT Show hidden files and folders.
* CHECK the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Next, let's clean your restore points and set a new one:

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Restart your computer.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
[/list]System Restore will now be active again.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

• SpywareBlaster to help prevent spyware from installing in the first place.
• SpywareGuard to catch and block spyware before it can execute.
• IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

You should also have a good firewall. Here are 3 free ones available for personal use:

• Sygate Personal Firewall
• Kerio Personal Firewall
• ZoneAlarm

and a good antivirus (these are also free for personal use):

• AVG Anti-Virus
• Avast Home Edition

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

monthly. And to keep your system clean run these free malware scanners

• Ad-Aware SE Personal
• Spybot Search & Destroy

weekly, and be aware of what emails you open and websites you visit.

Security Updates - Softwares:
http://www.geekstogo.com/forum/Security-Updates-f69.html

To learn more about how to protect yourself while on the internet read this article by Tony Klein: So how did I get infected in the first place?

[kool808]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.