Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Winfix 2005 Infection [RESOLVED]


  • This topic is locked This topic is locked

#1
Bazwell

Bazwell

    Member

  • Member
  • PipPip
  • 11 posts
Hi guys. The last few days ive had a problem with a series of popups called Winfix 2005. Ive run a few programs to try and get rid of it (Vet Anti-Virus, Virobot & Adaware Personal) but have had no luck. I downlaoded Hijackthis and created a log for you to view:

Logfile of HijackThis v1.99.1
Scan saved at 4:44:37 PM, on 10/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Vet\VetTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Bazza\LOCALS~1\Temp\se.dll/sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: C:\WINDOWS\adsldpbc.dll - {0FCCA392-4877-4286-8644-7460E351DB27} - C:\WINDOWS\adsldpbc.dll
O2 - BHO: (no name) - {11111111-2222-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\netdde.dll
O2 - BHO: (no name) - {16875E09-927B-4494-82BD-158A1CD46BA0} - C:\WINDOWS\system32\prflbmsgp32.dll
O2 - BHO: (no name) - {8D82BB89-B58C-4F21-9C5D-377F65947806} - C:\WINDOWS\slassac.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [dmsrk.exe] C:\WINDOWS\System32\dmsrk.exe
O4 - HKLM\..\Run: [VrBootScan] C:\Program Files\ViRobotXP\VRBScan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/...h/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103268532328
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.glob...up/vrupdate.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveap01.righ...l/java/RntX.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9D1039-4AD8-40CF-AB46-9287E85C816C}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0CE19DD-B4D1-4F51-B194-D263560BD87D}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{D17A0739-A836-46F8-BED1-8411B4B22046}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CS2\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CS3\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O20 - AppInit_DLLs: w8c6s4xcm66s.dll
O20 - Winlogon Notify: style2 - C:\WINDOWS\q512765_disk.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\system32\winstyle3.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: distributed.net client (dnetc) - Unknown owner - C:\WINDOWS\System32\iosdt\iosdt.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - C:\Program Files\ViRobotXP\vrmonsvc.exe

Thanks in advance for the help guys :tazz:
  • 0

Advertisements


#2
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Hi and welcome Bazwell
You have a few nasty infections here, Could help us out here we would like to get a closer look at a couple of files from your system please,
Could you please submit the following files,

C:\WINDOWS\netdde.dll
and
C:\WINDOWS\slassac.dll

Please submit them to submit_stuffATxs4all.nl (replace 'AT' by @)

You may have to unhide systems folders in order to find them if so please follow the steps fromHere

Let me know when you have done this and we will get started cleaning you up
  • 0

#3
Bazwell

Bazwell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Gday Don77, i just posted both files you requested to ur email. I named the email as "netdde.dll and slassac.dll from bazwell". Cheers for ur help mate :tazz:
  • 0

#4
TonyKlein

TonyKlein

    Malware Expert

  • Expert
  • 642 posts
  • MVP
Thanks for submitting the files! :tazz:


At Jotti online malware scan only VBA32's heuristics found anything amiss...


File: netdde.dll

VBA32 Found Trojan.Clicker.Agent.2 (paranoid heuristics) (probable variant)


File: slassac.dll

VBA32 Found Trojan.Clicker.Agent.2 (paranoid heuristics) (probable variant)

Cheers,

Edited by TonyKlein, 16 October 2005 - 03:40 PM.

  • 0

#5
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Thank you Bazwell, And thanks again Tony
Lets get started here Bazwell

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

This will likely be a few step process in removing the malware that has infected your system. I encourage you to stick with it and follow my directions as closely as possible so as to avoid complicating the problem further.

You have a nasty CoolWebSearch infection. First we will need to download a few tools that will help us in the removal of your problem.

Download about:buster by RubbeRDuckY Here.
Download CWShredder Here.
Download SpSeHjfix Here.
Download and install CleanUp! Here

Save all of these files somewhere you will remember like to the Desktop.

Unzip SpSeHjfix to its own folder (ie c:\SpSeHjfix)

Run the CleanUp! installer. You dont need to do anything with it right now.

Update About:Buster
  • Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
  • Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
  • Click "OK" at the prompt with instructions.
  • Click "Update" and then "Check For Update" to begin the update process.
  • If any updates exist please download them by clicking "Download Update" then click the X to close that window.
  • Now close About:Buster
Update CWShredder
  • Open CWShredder and click I AGREE
  • Click Check For Update
  • Close CWShredder
Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Please run about:buster by RubbeRDuckY:
  • Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
  • Click Yes to allow it to shutdown explorer.exe.
  • It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
  • When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
  • Reboot your computer into safe mode again
Run about:buster again following the same instructions as above, this time without the restart at the end

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

Now run SpSeHjfix. A log will be saved in the same folder that you put the exe into. Please post the results of that log in your next reply.

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
Click OK
Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

Please run an on-line virus scan at ActiveScan
or BitDefender. (Please post the results of the scan(s) in your next reply)

After all that, please post back with how things went as well as the logs requested and a new HiJackThis log.
  • 0

#6
Bazwell

Bazwell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Thanks for the instructions Don. I followed then to how u said, and didnt have any problems... phew.... lol

I got the logs u requested, as follows:

About:Buster Log

Scanned at: 5:39:22 PM on: 10/17/2005


-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 19

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 19

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

SPSeHjFix


(10/17/05 5:47:13 PM) SPSeHjFix started v1.1.2
(10/17/05 5:47:13 PM) OS: WinXP Service Pack 1 (5.1.2600)
(10/17/05 5:47:13 PM) Language: english
(10/17/05 5:47:13 PM) Win-Path: C:\WINDOWS
(10/17/05 5:47:13 PM) System-Path: C:\WINDOWS\System32
(10/17/05 5:47:13 PM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(10/17/05 5:47:14 PM) Disinfection started
(10/17/05 5:47:14 PM) Bad-Dll(IEP): (not found)
(10/17/05 5:47:14 PM) Bad-Dll(IEP) in BHO: (not found)
(10/17/05 5:47:14 PM) UBF: 5 - UBB: 5 - UBR: 8
(10/17/05 5:47:14 PM) UBF: 5 - UBB: 5 - UBR: 8
(10/17/05 5:47:14 PM) Bad IE-pages:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar:
(10/17/05 5:47:14 PM) Stealth-String not found
(10/17/05 5:47:14 PM) Not infected->END


Activescan


Incident Status Location

Adware:adware/cws No disinfected C:\Documents and Settings\All Users\Favorites\AdultGambling.url
Adware:Adware/Miamore No disinfected C:\WINDOWS\adsldpbc.dll
Virus:Trj/Downloader.FFD Disinfected C:\WINDOWS\q512765_disk.dll
Adware:adware/sbsoft No disinfected C:\WINDOWS\rdt.ini
Possible Virus. No disinfected C:\WINDOWS\slassac.dll
Adware:Adware/Megatds No disinfected C:\WINDOWS\system32\cshex.exe
Possible Virus. No disinfected C:\WINDOWS\system32\prflbmsgp32.dll
Adware:Adware/XPlugin No disinfected C:\WINDOWS\system32\sysupd1003.exe
Dialer:Dialer.DKH No disinfected C:\WINDOWS\system32\winstyle3.dll
Adware:Adware/AzeSearch No disinfected C:\WINDOWS\system32\ztoolb011.dll


BitDefender

Scanned File
Status

C:\WINDOWS\adsldpbc.dll
Infected with: BehavesLike:Trojan.TrustedZone

C:\WINDOWS\adsldpbc.dll
Disinfection failed

C:\WINDOWS\adsldpbc.dll
Delete failed

C:\WINDOWS\system32\cshex.exe
Suspected of: BehavesLike:Trojan.ShellStartup

C:\WINDOWS\system32\cshex.exe
Disinfection failed

C:\WINDOWS\system32\cshex.exe
Deleted


HiJackthis



Logfile of HijackThis v1.99.1
Scan saved at 7:26:38 PM, on 10/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Vet\VetTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: C:\WINDOWS\adsldpbc.dll - {0FCCA392-4877-4286-8644-7460E351DB27} - C:\WINDOWS\adsldpbc.dll
O2 - BHO: (no name) - {11111111-2222-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\netdde.dll
O2 - BHO: (no name) - {16875E09-927B-4494-82BD-158A1CD46BA0} - C:\WINDOWS\system32\prflbmsgp32.dll
O2 - BHO: (no name) - {8D82BB89-B58C-4F21-9C5D-377F65947806} - C:\WINDOWS\slassac.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [dmsrk.exe] C:\WINDOWS\System32\dmsrk.exe
O4 - HKLM\..\Run: [VrBootScan] C:\Program Files\ViRobotXP\VRBScan.exe
O4 - HKLM\..\RunOnce: [Panda_cleaner_213123] C:\WINDOWS\System32\ActiveScan\pavdr.exe 213123
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/...h/v2/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103268532328
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.glob...up/vrupdate.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveap01.righ...l/java/RntX.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9D1039-4AD8-40CF-AB46-9287E85C816C}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0CE19DD-B4D1-4F51-B194-D263560BD87D}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{D17A0739-A836-46F8-BED1-8411B4B22046}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CS2\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CS3\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O20 - AppInit_DLLs: w8c6s4xcm66s.dll
O20 - Winlogon Notify: style2 - C:\WINDOWS\q512765_disk.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\system32\winstyle3.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Documents and Settings\Bazza\Desktop\malware removal stuff\CWShredder.exe
O23 - Service: distributed.net client (dnetc) - Unknown owner - C:\WINDOWS\System32\iosdt\iosdt.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - C:\Program Files\ViRobotXP\vrmonsvc.exe


Thats the lot mate, lets hope its fixed some of it :tazz:

Thanks again :)
  • 0

#7
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Yes a little better we have a bit of work to go yet,
Please read through the following instructions probably a good idea to print them out or save to notepad somewhere on your desk top so you have access to them,

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

Next, please reboot your computer in SafeMode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
Now scan with HJT and place a checkmark next to each of the following items:
===================================================
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)
O2 - BHO: C:\WINDOWS\adsldpbc.dll - {0FCCA392-4877-4286-8644-7460E351DB27} - C:\WINDOWS\adsldpbc.dll
O2 - BHO: (no name) - {11111111-2222-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\netdde.dll
O2 - BHO: (no name) - {16875E09-927B-4494-82BD-158A1CD46BA0} - C:\WINDOWS\system32\prflbmsgp32.dll
O2 - BHO: (no name) - {8D82BB89-B58C-4F21-9C5D-377F65947806} - C:\WINDOWS\slassac.dll
O4 - HKLM\..\Run: [dmsrk.exe] C:\WINDOWS\System32\dmsrk.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O15 - Trusted Zone: *.coolwebsearch.com
O15 - Trusted Zone: *.searchmeup.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB9D1039-4AD8-40CF-AB46-9287E85C816C}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0CE19DD-B4D1-4F51-B194-D263560BD87D}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CCS\Services\Tcpip\..\{D17A0739-A836-46F8-BED1-8411B4B22046}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CS2\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O17 - HKLM\System\CS3\Services\Tcpip\..\{0291E0F9-9CED-4D97-B935-B2124A031FD1}: NameServer = 85.255.113.99,85.255.112.24
O20 - AppInit_DLLs: w8c6s4xcm66s.dll
O20 - Winlogon Notify: style2 - C:\WINDOWS\q512765_disk.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\system32\winstyle3.dll


===================================================
Make sure all open windows are closed and click on " Fixe Checked"


Next,
Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop
Close Ewido


Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked!
Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.
Let us know if any problems persist.
  • 0

#8
Bazwell

Bazwell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Ok, ive done the next set of you instructions, but i had a problem with the hijack this scan whilst i was in safe mode. It was missing all of the Microsoft AntiSpyware helper lines that you said to tick. But as u will see in the normal windows mode, they are still present. My logs are as follows:

Smitfiles



smitRem log file
version 2.7

by noahdfear

The current date is: Mon 10/17/2005
The current time is: 21:24:16.00

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN! :tazz:



Ewido Log


---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:47:22 PM, 10/17/2005
+ Report-Checksum: D9FD5AFA

+ Scan result:

[224] C:\WINDOWS\system32\winstyle3.dll -> TrojanDownloader.Delf.h : Cleaned with backup
[748] C:\WINDOWS\system32\winstyle3.dll -> TrojanDownloader.Delf.h : Error during cleaning
C:\WINDOWS\system32\prflbmsgp32.dll -> TrojanDownloader.Delf.vt : Cleaned with backup
C:\WINDOWS\system32\sysupd1003.exe -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINDOWS\system32\winstyle3.dll -> TrojanDownloader.Delf.h : Cleaned with backup
C:\WINDOWS\system32\ztoolb011.dll -> Spyware.Zbar : Cleaned with backup


::Report End



Activescan


Incident Status Location

Adware:adware/cws No disinfected C:\Documents and Settings\All Users\Favorites\AdultGambling.url
Possible Virus. No disinfected C:\HJT\hijackthis\backups\backup-20051017-212317-982.dll
Adware:adware/sbsoft No disinfected C:\WINDOWS\rdt.ini
Dialer:Dialer.DKH No disinfected C:\WINDOWS\system32\__delete_on_reboot__winstyle3.dll


Hijackthis


Logfile of HijackThis v1.99.1
Scan saved at 10:55:35 PM, on 10/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Vet\VetTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [VrBootScan] C:\Program Files\ViRobotXP\VRBScan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O15 - Trusted Zone: *.coolwebsearch.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/...h/v2/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103268532328
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.glob...up/vrupdate.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveap01.righ...l/java/RntX.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - Winlogon Notify: style32 - C:\WINDOWS\system32\winstyle3.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Documents and Settings\Bazza\Desktop\malware removal stuff\CWShredder.exe
O23 - Service: distributed.net client (dnetc) - Unknown owner - C:\WINDOWS\System32\iosdt\iosdt.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - C:\Program Files\ViRobotXP\vrmonsvc.exe



Thats the lot i think :)

Cheers guys :woot:
  • 0

#9
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Getting better,

Go to Start > Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the below services:

distributed.net client

When you find it, double-click on it. In the next window that opens, under the General tab click the Stop button, then click the drop-down box to change the Startup Type to Disabled. Now hit Apply and then Ok.

Open HiJackThis, click on "None of the above, just start the program". Now, click on the "Config" button (bottom right), then click on "Misc Tools", then click on "Delete an NT Service" a window will pop up. Enter the below item into that field (make sure there are NO spaces before or after the name):

dnetc

Click OK.

It should pull up information about the service, then ask if you want to reboot. Click YES.


On reboot
Please restart HJT put a check next to the following, close all open windows and click “Fix Checked”

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1523B22B-0605-4F37-B94C-ED37211BFCEA} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {24AC42C6-8E32-42AF-BB8D-BB5665988E35} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {82CA1702-F9FE-40BF-AC13-D0A686DA0162} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A89FA4EF-FB98-4DD3-81BA-D861EAF2A95B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {EE0D410B-D6AC-47A9-BEEE-2AB5AFF86346} - (no file) (HKCU)
O15 - Trusted Zone: *.coolwebsearch.com
O20 - Winlogon Notify: style32 - C:\WINDOWS\system32\winstyle3.dll (file missing)


Restart your computer one more time and post back a fresh HJT log for me please
  • 0

#10
Bazwell

Bazwell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Alrighty, stage 3 been done :tazz: Here is the latest Hijackthis logfile u needed mate:

Logfile of HijackThis v1.99.1
Scan saved at 5:00:53 PM, on 10/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Vet\VetTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [VrBootScan] C:\Program Files\ViRobotXP\VRBScan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/...h/v2/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103268532328
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.glob...up/vrupdate.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveap01.righ...l/java/RntX.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Documents and Settings\Bazza\Desktop\malware removal stuff\CWShredder.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - C:\Program Files\ViRobotXP\vrmonsvc.exe

Hope its lookin better now :)

Thanks again :woot:
  • 0

#11
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
:tazz:
Nice job your log is clean !
How is it running ?
Please use the following suggestion to help prevent reinfection


Download the following program, For keeping crap off your system to begin with
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests. Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox. Restrict the actions of potentially dangerous sites in Internet Explorer.
Download Spyware Blaster

Keep AD-Aware. and Spybot 1.3 handy, Check them for updates prior to running and run them weekly
Same with your Anti Virus,

For an added check run an online virus scan, you can use one of the 2 below,
TrendMicro's HouseCall
ActiveScan

Be sure and give the Temp folders a cleaning out now and then as well, Make sure after you clean your Temp files to empty out your Recycle bin as well.
Click Start | Run | type in cleanmgr | OK

Let it scan your system for files to remove.

Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.

Press OK to remove them.


Remeber to Check Windows for updates

Probably a good time to create a new restore point See Here for XP

See Here for ME Name it clean or something like that,
  • 0

#12
Bazwell

Bazwell

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Thanks for all your time and patience Don, i really appreciate ur prompt replies. Ill follow the instructions u gave me mate, and lets hope i dont get this garbage again :tazz:

The puter runnin a whole lot better now, huge difference :)

I want to thank you again for all your help mate :woot:
  • 0

#13
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
My pleasure :tazz:
  • 0

#14
don77

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP