[Syroco]

I have put up with these popups and un recognized installations long enough. Time to get help!


Logfile of HijackThis v1.98.2
Scan saved at 10:59:58 PM, on 11/30/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
C:\WINDOWS\system32\appdm32.exe
C:\Documents and Settings\Patti\Application Data\eetu.exe
C:\WINDOWS\System32\??chost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\windt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\Uabue.exe
C:\WINDOWS\System32\FkkE1.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\glgzq.dll/sp.html#29126
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {D3160675-30B4-FD47-FEA2-65366FA2D795} - C:\WINDOWS\ntal.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [1tyjz3H] C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
O4 - HKLM\..\Run: [4Kw] C:\documents and settings\patti\local settings\temp\4Kw.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Oval73H.exe
O4 - HKLM\..\Run: [appdm32.exe] C:\WINDOWS\system32\appdm32.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Patti\Application Data\eetu.exe
O4 - HKCU\..\Run: [Zhipvyh] C:\WINDOWS\System32\??chost.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab

[Advertisements]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

-=jonnyrotten=-

[-=jonnyrotten=-]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

-=jonnyrotten=-

[Syroco]

It wont open.. just extracts then closes.

[admin]

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

Reboot your PC.

See of you're able to install SP1.

If you would please, rescan with HijackThis and post a fresh log in this same topic.

[Syroco]

Nevermind, I got the SP1 installed with out any problems. Ok here is my new log. (i just got back frm work sorry for late reply)


Logfile of HijackThis v1.98.2
Scan saved at 4:20:20 PM, on 12/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\windt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
C:\documents and settings\patti\local settings\temp\4Kw.exe
C:\WINDOWS\system32\appdm32.exe
C:\Documents and Settings\Patti\Application Data\eetu.exe
C:\WINDOWS\System32\??chost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\OkrN0Z44.exe
C:\WINDOWS\System32\FkkE1.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {D3160675-30B4-FD47-FEA2-65366FA2D795} - C:\WINDOWS\ntal.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Patti\Local Settings\Temp\huFeicT.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [1tyjz3H] C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
O4 - HKLM\..\Run: [4Kw] C:\documents and settings\patti\local settings\temp\4Kw.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\HqpX.exe
O4 - HKLM\..\Run: [appdm32.exe] C:\WINDOWS\system32\appdm32.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Patti\Application Data\eetu.exe
O4 - HKCU\..\Run: [Zhipvyh] C:\WINDOWS\System32\??chost.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab

[-=jonnyrotten=-]

First, we need to remove the pepper trojan. Download this file, run, and let terminate (it'll just blink briefly on your screen and won't appeared to have done much--this is normal):
http://www.geekstogo...=download&id=18

Next:
Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot

Go to control panel, add/remove programs and uninstall any or all of the following:

TV Media
Windows Adcontrol
NewDotNet (new.net)
WebRebates
WhenU
180 Solutions
myway
mysearch
mywebsearch
viewpoint manager
viewpoint
wild tangent
weatherbug
gain
gator
gmt
wintools
any searchbar/toolbar besides google

Reboot:

You may wish to print out a copy of these instructions to follow while you complete this procedure.
Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.
Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {D3160675-30B4-FD47-FEA2-65366FA2D795} - C:\WINDOWS\ntal.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Patti\Local Settings\Temp\huFeicT.dll
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [1tyjz3H] C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
O4 - HKLM\..\Run: [4Kw] C:\documents and settings\patti\local settings\temp\4Kw.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\HqpX.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Patti\Application Data\eetu.exe
O4 - HKCU\..\Run: [Zhipvyh] C:\WINDOWS\System32\??chost.exe

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):

C:\Documents and Settings\Patti\Application Data\eetu.exe
C:\WINDOWS\System32\??chost.exe
C:\WINDOWS\System32\OkrN0Z44.exe
C:\WINDOWS\System32\FkkE1.exe
C:\Program Files\WildTangent
C:\WINDOWS\System32\HqpX.exe

Reboot normally and post new log

-=jonnyrotten=-

[Syroco]

Okay about the Add/Remove things Im supposed to remove.

I found 3:


Shopping Wizard
Search Extender
Home Searc Assistant

everytime I try to remove these it brings me to this page:

http://looking-for.c...chExtender.html

the extention is the same with all of them
http://looking-for.c...pingwizard.html
etc.


I'm not gonna dowlnoad their product to unistall. I obviouly can strust them so.. any tips?

[-=jonnyrotten=-]

First tip is "wise choice" NEVER download something from the company to uninstall something they have put on your pc, as they are definitely untrustworthy. I will see if I can find the procedure for uninstalling this malware. Hang tight for a bit I'll have some new instructions very soon.

-=jonnyrotten=-

[-=jonnyrotten=-]

Click Here: -> http://www.geekstogo...=download&id=33

Download, Run, Click "Scan and Remove".

Post a new log when finished.

No guarantees on this first try anyways....good luck. I'll find out more.

-=jonnyrotten=-

[-=jonnyrotten=-]

Here's some more info on removing this infection:

http://www.short-med...ead.php?t=18846

Lets get a new hijack log to look at too

-=jonnyrotten=-

[Syroco]

Sorry, was playing a game xD

I'll run that program then post a new log. After I run that program should I reboot or?

[Syroco]

Okay, I ran that program still no luck. I unistalled Norton awhile ago for some lag issues. Do you strongly reccomend I reinstall Norton? And do a complete scan? HEre is my new HJT log:

Logfile of HijackThis v1.98.2
Scan saved at 9:22:59 PM, on 12/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
C:\WINDOWS\system32\appdm32.exe
C:\Documents and Settings\Patti\Application Data\eetu.exe
C:\WINDOWS\System32\??chost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\windt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\feeuu.dll/sp.html#29126
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7661973A-4117-72F9-F0EE-CF54843DB10D} - C:\WINDOWS\ipve.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [1tyjz3H] C:\documents and settings\patti\local settings\temp\1tyjz3H.exe
O4 - HKLM\..\Run: [4Kw] C:\documents and settings\patti\local settings\temp\4Kw.exe
O4 - HKLM\..\Run: [appdm32.exe] C:\WINDOWS\system32\appdm32.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Patti\Application Data\eetu.exe
O4 - HKCU\..\Run: [Zhipvyh] C:\WINDOWS\System32\??chost.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab

[admin]

Download CWShredder from http://www.intermute...r_download.html
Don't use it yet.

Download the Backdoor.Agent.B Removal Tool from Symantec.
- Follow Symantec's instructions for how to run it.
- Be sure to save the log file. I will need to see it later.
- Restart your computer.

- Now run CWShredder before you open any IE windows. Be sure to click Fix as opposed to Scan Only. It should find some things and remove them.
- Restart your computer once more.
- Post a new HijackThis log and the log Symantec's tool gave you.

[Syroco]

I dont use IE, i quit it ever sinse it got jacked. i now use mozilla

[Syroco]

Umm i did that one program the backdoor one.. it said something could not be found...