I got tons of spyware etc suddenly install on my PC in one go. I was probably online for 30 mins before I pulled the plug on my internet connection.
I've gone through the steps as advised on this site. I've hardly been back on the net since (I'm using a different PC now) - only reconnected to get updates for software.
I also updated from XP home to SP2, which I realise now was a mistake, but I did that before finding this site.
I've since used Cleanup, cwshredder, adaware, spybot S&D, ewido and TrojanHunter. Early on, I also used my Norton AntiVirus 2005, which was totally useless as far as I could tell. I have disabled it while Ewido is installed. I also edited the registry to get rid of Surfsidekick (instructions were on the Symantec site). Overall, most of the nasties have gone, I think, but it looks like I'm not clean just yet.
If anyone can help me out, I'd be eternally grateful!
Thanks,
Rob
Ewido log
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 19:45:29, 14/08/2005
+ Report-Checksum: 5C3D487A
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{B5AB638F-D76C-415B-A8F2-F3CEAC502212} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{BC333116-6EA1-40A1-9D07-ECB192DB8CEA} -> Spyware.AproposMedia : Cleaned with backup
HKU\S-1-5-21-1812864381-4086601109-1325006524-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
[1300] C:\WINDOWS\system32\DrPMon.dll -> Adware.BetterInternet : Cleaned with backup
[2468] C:\WINDOWS\cfgmgr52.dll -> Spyware.BookedSpace : Error during cleaning
[216] C:\WINDOWS\system32\lodzgm.exe -> Trojan.Agent.cp : Cleaned with backup
C:\Documents and Settings\Windows user\Cookies\windows user@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc12.dll -> Spyware.SafeSurfing : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc13.exe -> Spyware.SafeSurfing : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc16.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc17.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc2.exe -> TrojanDownloader.Agent.qg : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc24.exe -> TrojanDownloader.Apropo.ae : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc26.exe -> Spyware.Apropos : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc3.exe -> Spyware.Pacer : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc34\casstub.exe -> TrojanDownloader.Agent.qg : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc5.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc62.dll -> Spyware.EliteBar : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc63.exe -> Spyware.EliteBar : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc65.dll -> Spyware.EliteBar : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc66.exe -> Spyware.EliteBar : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc67.dll -> Spyware.EliteBar : Cleaned with backup
C:\RECYCLER\S-1-5-21-1812864381-4086601109-1325006524-500\Dc68.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP48\A0002739.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002759.exe -> TrojanDownloader.QDown.z : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002760.exe -> TrojanDownloader.Qoologic.v : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002767.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002774.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002775.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002784.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002789.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002791.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002796.exe -> Spyware.AproposMedia : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002797.dll.tcf -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002798.dll.tcf -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002799.dll -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002800.dll.tcf -> Spyware.VirtualBouncer : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002801.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002965.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002970.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP50\A0002972.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005264.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005275.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005288.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005292.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005293.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005307.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005309.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP51\A0005311.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP53\A0005526.exe -> TrojanDownloader.Small.ayh : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP53\A0005883.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP53\A0005884.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP53\A0005890.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005901.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005908.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005946.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005957.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005973.exe -> Trojan.Agent.gp : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005990.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP54\A0005991.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\betjrizmdum.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\Nail.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\lodzgm.exe -> Trojan.Agent.gp : Cleaned with backup
C:\WINDOWS\system32\nsn412.dll -> Spyware.HotSearchBar : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__cfgmgr52.dll -> Spyware.BookedSpace : Cleaned with backup
::Report End
Hijack log:
Logfile of HijackThis v1.99.1
Scan saved at 20:52:13, on 14/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\WinPortrait\wpctrl.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Portrait Displays\forteManager\dtsrvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111.exe
C:\Program Files\Wacom\TabUserW.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\WinPortrait\floater.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.24-7searc...ore.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.24-7searc...ore.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.24-7searc...ore.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497 - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [PowSet] Wscript.exe //e:VBS C:\Drivers\Setpow.nec
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\ScanSoft\NaturallySpeaking\Program\Ereg.exe" -r "C:\Program Files\ScanSoft\NaturallySpeaking\Program\ereg.ini"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\WinPortrait\wpctrl.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\System32\lanbrup.exe
O4 - HKLM\..\Run: [v32P36X] jgawiz.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Portrait Displays\forteManager\dtsrvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe