Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

APROPOS giving very hard time!Help plz!


  • Please log in to reply

#1
Opie102

Opie102

    New Member

  • Member
  • Pip
  • 4 posts
Hi guys,
I work for a computer IT company and usually have no problem fix the spyware issues that our customers seem to get themselves into. But I have at last ran into one that has me banging my head against the monitor and wanting to leave and go get a drink.:tazz:
I have already removed many items from this system (VX2 variant, surfsidekick, CWS, etc.)and it seems to be down to this last one. APROPOS is what i keep getting. But no mater how manytimes I remove files i cant find the one that is putting everything back on. Here is a HiJack this log..which to me looks almost normal. The Files that i keep turning up in all my searches of the system are these, MSST.exe, SEMV.exe, and NFO.exe, there are also what look like random file names with .stub.exe in them.
I get this reg key that keeps coming back..it is Apropos i believe.
KHLM\software\Aprps\client the value in the key is WB.ver2

PS. Adaware,Spybot, CWShredder, Nailbit fixer, Apropos cleaning tool for norton, Been using REGMON and FILEMON to try and pinpoint the file that is re-initiating the reg keys, It has had numerous AV sweeps with norton corporate edition, stinger and online scans.

Any help would be greatly appreciated:)


Logfile of HijackThis v1.99.1
Scan saved at 11:18:58 AM, on 10/5/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
E:\spyware\Additional Tools\AutoRuns\autoruns.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Common Files\Windows\services32.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Common Files\services.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Common Files\services.exe
C:\WINDOWS\System32\wintask.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Owner\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:2323
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - (no file)
O2 - BHO: AdCom - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\system32\AdCom.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [adcomplusanalytic.exe] C:\WINDOWS\System32\adcomplusanalytic.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000106.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zone...canner37360.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\IOETAB32.DLL
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\svlgntfy.dll (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

Edited by Opie102, 06 October 2005 - 07:23 AM.

  • 0

Advertisements


#2
Opie102

Opie102

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
need a hand with this one, Im still unable to stop the pop-ups. OS is XP SP1. SP2 gives a windows stop error when i install it. That is a seperate issue lol. but really need some input on this one.
  • 0

#3
Opie102

Opie102

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
I know everyones prolly busy, but one last bump to see if I can get this done before close today:)
  • 0

#4
Opie102

Opie102

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Gonna give this one last shot before I Hose the system and start clean. Anybody have any ideas??
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP