[Wizard]

Try to Copy&Paste the logs to Notepad or try renaming the logs with .txt extension

Try Scanning the PC at Panda

Panda Active Scan

Save the Report and Post it!

Edited by Cretemonster, 17 August 2005 - 11:23 AM.

[Advertisements]

kaspersky log #1 and activescan logs attached.

Attached Files

•  kasp_norm_.txt   305.82KB   59 downloads
•  Activescan.txt   6.84KB   72 downloads

[jahred]

kaspersky log #1 and activescan logs attached.

Attached Files

•  kasp_norm_.txt   305.82KB   59 downloads
•  Activescan.txt   6.84KB   72 downloads

[jahred]

kaspersky log #2 attached.

Attached Files

•  kasp_safe_.txt   298.15KB   68 downloads

[Wizard]

Highlight the list below and press Ctrl+C to Copy!

C:\WINDOWS\SYSTEM32\msaps.dll
C:\WINDOWS\INF\alchem.inf
C:\WINDOWS\FT1_02_0_402_GEPFAH.EXE
C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\Lycos C:\WINDOWS\apipm32.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.INF
C:\WINDOWS\inf\alchem.inf
C:\WINDOWS\inf\conscorr.inf
C:\WINDOWS\system32\crrq32.exe
C:\WINDOWS\system32\msdipo.dll
C:\WINDOWS\system32\msfdje.gif
C:\WINDOWS\system32\xmltok.dll
C:\WINDOWS\temp\ASHeuristic\apipm32.exe.vir
C:\WINDOWS\temp\ASHeuristic\crrq32.exe.vir
C:\WINDOWS\temp\ASHeuristic\msdipo.dll.vir
C:\WINDOWS\temp\ASHeuristic

Open Pocket Killbox-> Click File-> Click Paste from Clipboard!

Place a tick by Delete on Reboot-> Click the Red Circle to Delete!

Click Yes to the Prompts that follow and let Killbox Reboot the PC!


Copy everything inside the quote box below (starting with dir) and paste it into notepad. Go up to "File > Save As" and click the drop-down box to change the "Save As Type" to "All Files". Save it as findfile.bat on your Desktop.

dir C:\WINDOWS\system32\m?dtc.exe /a h > files.txt
notepad files.txt

Locate findfile.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the contents of that Notepad here along with a new HiJackThis log.

[jahred]

here they are:

batch file log:

Volume in drive C has no label.
Volume Serial Number is A8E1-CAEB

Directory of C:\WINDOWS\system32

29/08/2002 09:30 AM 6,144 msdtc.exe
11/01/2005 11:43 AM 401,408 m?dtc.exe
2 File(s) 407,552 bytes

Directory of C:\Documents and Settings\Owner\Desktop

hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 12:34:22 AM, on 18/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ps2.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\No-IP\DUC20.exe
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\security\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Browser Adjustment - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\PROGRA~1\Agnitum\OUTPOS~1\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123677769921
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-sec...m/ols/fscax.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C3F00CB-136E-4982-8240-FC30B2366A51}: NameServer = 142.163.255.4 209.128.1.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{2C3F00CB-136E-4982-8240-FC30B2366A51}: NameServer = 142.163.255.4 209.128.1.4
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

[Wizard]

OK,Go into Safe Mode-> Double Check that Windows is Showing Hidden Files
http://www.bleepingc...ut62.html#winxp

Navigate to C:\Windows\System32

Once in the System32 folder,look for these 2

The good file will be

msdtc.exe<- Created in 8/29/2002 09:30 AM

With a size of 6,144 bytes or 6 Kb

The bad file will look similar but the ? can be anything so look closely please!

m?dtc.exe<- Created on 1/11/2005 11:43 AM

With a size of 401,408 bytes or 392 Kb

Get rid of that bad file and post back!

Let me know how everything is running now?

[jahred]

ok, found the file and deleted it (was also named msdtc.exe), but i did notice another suspicious file in the sys32 directory.. mstsc.exe, created august 10th 2005 with a size of 380k.

the system seems to be running perfectly though!

[Wizard]

mstsc.exe
http://www.liutiliti...slibrary/mstsc/

Disable System Restore
http://service1.syma...src=sec_doc_nam

Install these 2 for some added Security!

SpywareBlaster:
http://www.javacools...areblaster.html
Update Immediatly!


WinHelp2002 Hosts File
http://www.mvps.org/...p2002/hosts.htm

Made Easy
http://www.mvps.org/...2002/hosts2.htm

Restart the PC and Renable System Restore!

Please read through those 3 little black links in my signature to help you avoid this in the future!

Also,have a look at Metallicas Spyware Page
http://metallica.geekstogo.com/


Let me know if you have any other questions??

[jahred]

hey thanks so much crete, the old problems seem to be gone and there doesn't seem to be any new ones popping up. you've been an awesome help.