[Miracles]

Help!! I'm working on a system that seems to have accumulated quite a lot of rubbish. I've used AdAware, SpyBot and AVG to remove most of it, but there's one dialler remaining. SpyBot finds MagicControl Agent each time I run it,and says it's fixed, but when I run another scan, it's still there. Ewido gives a similar result, finding 7 "Infected Objects", but then reporting "Error during cleaning". I've run the scans in safe mode, and they both found and fixed the objects, but when I reboot, they are still there. Any help will be greatly appreciated.

Hijack This Log:
Logfile of HijackThis v1.99.1
Scan saved at 3:51:50 PM, on 10/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Documents and Settings\W Lyon\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.wintecactive.co.nz
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1128201742250
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

Ewido Report:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:08:55 AM, 10/3/2005
+ Report-Checksum: D52C4FD1

+ Scan result:

[1452] VM_014A1000 -> Dialer.Generic : Error during cleaning
[1676] VM_009F1000 -> Dialer.Generic : Error during cleaning
[1696] VM_10001000 -> Dialer.Generic : Error during cleaning
[1716] VM_010D1000 -> Dialer.Generic : Error during cleaning
[1740] VM_00B91000 -> Dialer.Generic : Error during cleaning
[1768] VM_015C1000 -> Dialer.Generic : Error during cleaning
[1780] VM_010C1000 -> Dialer.Generic : Error during cleaning
[1808] VM_01A21000 -> Dialer.Generic : Error during cleaning


::Report End

[Advertisements]

Hello Miracles and welcome to Geeks To Go

Been a little busy around here lately, are you still needing our help?

[John_L]

Hello Miracles and welcome to Geeks To Go

Been a little busy around here lately, are you still needing our help?

[Miracles]

Hello, John.

I see things have been hectic there, but thanks for coming back to me. Yes, I still have the Magic Control Agent coming up every time I run SpyBot. SpyBot then "fixes" the entry, but next time I run it, there it is right back again. Any help you can give will be very much appreciated.

[John_L]

Hello Again

I don't see a heck of a lot wrong in your log, lets try an online scan and see what it does for us.

Please do an online virus scan with Panda ActiveScan Here. You need to use Internet Explorer for this scan.

• Once you get to the Panda site, scroll down a bit and click on Scan your PC
• A new window will appear; click on Check Now!
• A new window will appear; fill in the boxes (Country, State, email addy)
• Click on Scan Now! >
  If you have never used ActiveScan before, you will be prompted to install an ActiveX control (asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files.
• From "Select a device to scan...", choose "My Computer"
• Allow the scan to run. It'll take a while.
• When complete, click on "See Report", and then on "Save report"; save it to a convenient location.
• I will need you to post that report in your next reply; simply open the text file, then copy/paste the content here.

When this is done please show me a new hijack log.

[Miracles]

Hi John,

Panda Log:

Incident Status Location

Adware:adware/navipromo No disinfected Windows Registry
Dialer:Dialer.CAB No disinfected C:\WINDOWS\Downloaded Program Files\picmag_1w.exe
HJT Log:
Logfile of HijackThis v1.99.1
Scan saved at 11:20:40 AM, on 10/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\W Lyon\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O15 - Trusted Zone: http://www.wintecactive.co.nz
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1128201742250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

[John_L]

Well on a good note i see less now than i did before Did anything change for you?

[Miracles]

Hi again John,

I'll be away from the computer for a few hours now, but look forward to your further assistance on my return.

Thanks.

[Miracles]

Hi John,

Looks as if I might be getting there. I cleaned a couple of traces of MC and SLAgent out of the registry, but got the same results as before from Panda and SpyBot. Then I ran AdAware, which found and removed a couple of items. Here's the report:

ArchiveData(auto-quarantine- 2005-10-09 19-00-01.bckp)
Referencefile : SE1R69 05.10.2005
======================================================

EGROUP DIALER
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=Regkey : S-1-5-21-3464014514-3941539683-980751038-1006\software\egdhtml

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[1]=IECache Entry : Cookie:w [email protected]/cgi-bin


Booted into Safe Mode and ran AdAware and SpyBot again, and both were clean. Back into Normal Mode, AdAware is clean, SpyBot is still finding the same item:
MagicControl.Agent: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-3464014514-3941539683-980751038-1006\Software\LanConfig


--- Spybot - Search && Destroy version: 1.3 ---
2005-10-07 Includes\Cookies.sbi
2005-10-07 Includes\Dialer.sbi
2005-10-07 Includes\Hijackers.sbi
2005-10-07 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2005-10-07 Includes\Malware.sbi
2005-10-07 Includes\PUPS.sbi
2005-10-07 Includes\Revision.sbi
2005-10-07 Includes\Security.sbi
2005-10-07 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-10-07 Includes\Trojans.sbi

And another HiJack This Log:
Logfile of HijackThis v1.99.1
Scan saved at 7:36:34 PM, on 10/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\regedit.exe
C:\Documents and Settings\W Lyon\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O15 - Trusted Zone: http://www.wintecactive.co.nz
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1128201742250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downl...svc32_EN_XP.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

It looks as if the popups and random ads have stopped, so perhaps the system is now clean?

Thanks.

[Miracles]

OOps... looks as if I spoke too soon... The popups and ads are back!

SpyBot still finds MagicControl Agent each time I scan.

I remove the entries it finds, but after a reboot they come back again.

Ewido finds 8 or 9 infected items but crashes before it can finish its scan.

Any thoughts?

Thanks...

[Miracles]

OOps... looks as if I spoke too soon... The popups and ads are back!

SpyBot still finds MagicControl Agent each time I scan.

I remove the entries it finds, but after a reboot they come back again.

Ewido finds 8 or 9 infected items but crashes before it can finish its scan.

Any thoughts?

Thanks...

[John_L]

Hello

Spybot should get rid of that problem that you are having. I see that you are still using a little oudated version you are running version 1.3 and should be using ver 1.4

Also Adaware has been updated to 1.06, so update those applications to there newest version and give them a run. If that doesn't help let me know.

[Miracles]

Hi John,

Thanks for your help and patience - it is very much appreciated.

I've updated both SpyBot and AdAware, but the results are the same as before - SpyBot finds and "fixes" one or two items, but they come back again as soon as I reboot. If I manually delete the registry entry ( HKEY_USERS\S-1-5-21-3464014514-3941539683-980751038-1006\Software\LanConfig
) it reappears after the next boot.

AdAware shows the same result also - finds and "removes" obj[1]=IECache Entry : Cookie:w [email protected]/cgi-bin but then does the same all over again if I rescan after a reboot.

I also tried ewido again, but got the same result as before - finds 8 or 9 objects and "fixes" them, but the logfile shows Dialer.Generic : Error during cleaning for each of them.

I'm close to reformatting the HDD, as there's not much on there at present, but any other suggestions would be appreciated.

Thanks again.

[John_L]

Hi Miracles

Lets try this application and see what it does for us.

http://www.webroot.c...umer/downloads/

your looking for the trial of spysweeper, run that and let me know what happens.

[Miracles]

Hi John,

Thanks again!

Here's the log from SpySweeper:
********
2:20 PM: | Start of Session, Wednesday, October 12, 2005 |
2:20 PM: Spy Sweeper started
2:20 PM: Sweep initiated using definitions version 553
2:20 PM: Starting Memory Sweep
2:22 PM: Memory Sweep Complete, Elapsed Time: 00:02:05
2:22 PM: Starting Registry Sweep
2:23 PM: Registry Sweep Complete, Elapsed Time:00:00:34
2:23 PM: Starting Cookie Sweep
2:23 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
2:23 PM: Starting File Sweep
2:24 PM: Found Adware: instant access
2:24 PM: msclock32.dll (ID = 158351)
2:25 PM: egauth_1046_en_xp[1].cab (ID = 157310)
2:28 PM: backup-20051005-145808-654.inf (ID = 156922)
2:28 PM: backup-20051005-145809-183.inf (ID = 156922)
2:28 PM: backup-20051005-145809-748.inf (ID = 156922)
2:28 PM: backup-20051005-145810-223.inf (ID = 156922)
2:28 PM: backup-20051005-145810-176.inf (ID = 156922)
2:28 PM: File Sweep Complete, Elapsed Time: 00:05:40
2:28 PM: Full Sweep has completed. Elapsed time 00:08:23
2:28 PM: Traces Found: 7
2:30 PM: Removal process initiated
2:30 PM: Quarantining All Traces: instant access
2:30 PM: instant access is in use. It will be removed on reboot.
2:30 PM: msclock32.dll is in use. It will be removed on reboot.
2:31 PM: Preparing to restart your computer. Please wait...
2:31 PM: Removal process completed. Elapsed time 00:00:11
********
2:18 PM: | Start of Session, Wednesday, October 12, 2005 |
2:18 PM: Spy Sweeper started
2:19 PM: Your spyware definitions have been updated.
2:20 PM: Updating spyware definitions
2:20 PM: Your definitions are up to date.
2:20 PM: | End of Session, Wednesday, October 12, 2005 |

I rebooted and ran the scan again, with the following results:

********
2:37 PM: | Start of Session, Wednesday, October 12, 2005 |
2:37 PM: Spy Sweeper started
2:37 PM: Sweep initiated using definitions version 553
2:37 PM: Starting Memory Sweep
2:39 PM: Memory Sweep Complete, Elapsed Time: 00:01:53
2:39 PM: Starting Registry Sweep
2:39 PM: Registry Sweep Complete, Elapsed Time:00:00:30
2:39 PM: Starting Cookie Sweep
2:39 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
2:39 PM: Starting File Sweep
2:41 PM: Found Adware: instant access
2:41 PM: msclock32.dll (ID = 158351)
2:45 PM: File Sweep Complete, Elapsed Time: 00:05:31
2:45 PM: Full Sweep has completed. Elapsed time 00:08:00
2:45 PM: Traces Found: 1
2:46 PM: Removal process initiated
2:46 PM: Quarantining All Traces: instant access
2:46 PM: instant access is in use. It will be removed on reboot.
2:46 PM: msclock32.dll is in use. It will be removed on reboot.
2:46 PM: Preparing to restart your computer. Please wait...
2:46 PM: Removal process completed. Elapsed time 00:00:18

[John_L]

Hi Miracles

I see that did something, did it clear your problem or no?

If no then please send me a new log and we can bash on.