Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

elite bar issue or pokapoka76? [RESOLVED]


  • This topic is locked This topic is locked

#1
balddog

balddog

    New Member

  • Member
  • Pip
  • 7 posts
I have a problem w/ daughter's machine. I suspect from doing Instant Messaging . I had the pokapoka76.exe, yet have not detected it since I have done many steps as I have read some other similar symptons. I feel like I am close, yet need help. When I try to open edit registry to look, the window will open and close in a bout 2 seconds, so I am struggling a little. Internet connection is slugish, and cannot manuver on the net. If I repair my network connection, I can hop online, then when trying to launch into new window, I am no longer on-line.

I did a disk clean up
Ran Hijack this and detected some areas of concern
Ran ewido
Ran killbox
Ran LGfix
ETRemover
I am now including the Hijack this log. I suspect the R1 files are posing an issue, yet am unable to get them to stay off the system.
Thanks very much for any guidance and your valuable time.
Logfile of HijackThis v1.99.1
Scan saved at 8:29:14 PM, on 10/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoguard.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\outlook-express.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\WINDOWS\system32\AMSNMGR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe
C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
C:\Documents and Settings\dad\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.sho...h.cgi?uid=&id=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.sho...h.cgi?uid=&id=0
O2 - BHO: Band Class - {00027925-0017-4faf-9539-90E4AC0B9EC5} - C:\WINDOWS\eltt.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [180sa] c:\program files\180search assistant\180sa.exe
O4 - HKLM\..\Run: [Windows HTTP service2] winhttp.exe
O4 - HKLM\..\Run: [MSN Funny Images] imsngsr.exe
O4 - HKLM\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Keyboard Driver (do not remove)] AMSNMGR.EXE
O4 - HKLM\..\RunServices: [Windows HTTP service2] winhttp.exe
O4 - HKLM\..\RunServices: [MSN Funny Images] imsngsr.exe
O4 - HKLM\..\RunServices: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Keyboard Driver (do not remove)] AMSNMGR.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Edited by balddog, 18 October 2005 - 09:47 PM.

  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Welcome to GTG.

Does Ewido find and remove everything it finds?

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. Also if you have any programs that may prevent system changes (like Spybot's TeaTimer program, Ad-aware's Ad-Watch, and others), make sure you disable them before doing any of the fixes (or accept the changes for the fix we give you when asked by the programs).

Go to My Computer->Tools (or View)->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders (it's Show all files for Windows 98).
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm and then click OK.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Make sure you downloaded, installed, updated and ran these programs (run in Safe Mode) already - Ad-aware, Spybot and Ewido (only if you have Windows 2000 or XP). If you didn't, do them now. For more information, go to http://www.greyknigh...com/spyware.htm

Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingc...showtutorial=61 ). Make sure to close any open browsers.

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if found:

180 Search Assistant

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.sho...h.cgi?uid=&id=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.sho...h.cgi?uid=&id=0
O2 - BHO: Band Class - {00027925-0017-4faf-9539-90E4AC0B9EC5} - C:\WINDOWS\eltt.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O4 - HKLM\..\Run: [180sa] c:\program files\180search assistant\180sa.exe
O4 - HKLM\..\Run: [Windows HTTP service2] winhttp.exe
O4 - HKLM\..\Run: [MSN Funny Images] imsngsr.exe
O4 - HKLM\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKLM\..\Run: [Keyboard Driver (do not remove)] AMSNMGR.EXE
O4 - HKLM\..\RunServices: [Windows HTTP service2] winhttp.exe
O4 - HKLM\..\RunServices: [MSN Funny Images] imsngsr.exe
O4 - HKLM\..\RunServices: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\RunOnce: [Keyboard Driver (do not remove)] AMSNMGR.EXE


Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\WINDOWS\system32\outlook-express.exe
C:\WINDOWS\system32\AMSNMGR.EXE
C:\WINDOWS\eltt.dll
C:\Program Files\DNS\
c:\program files\180search assistant\
winhttp.exe
imsngsr.exe


Restart and run these scans:

Run an online virus scan at TrendMicro http://housecall60.t...orp.asp?id=scan. Just follow the instructions on the site to run the free online scan. If any viruses/trojans are detected, try to delete or clean them in that site. If any are not cleanable, copy and paste the infected files here. Also run Panda ActiveScan at http://www.pandasoft...ucts/activescan. Post the log from the Panda scan here along with a new HijackThis log.
  • 0

#3
balddog

balddog

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Thanks, will begin on these now...
  • 0

#4
balddog

balddog

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Active Scan posted, thanks for your time and effort:
Incident Status Location

Adware:adware/beginto No disinfected C:\WINDOWS\SYSTEM32\dsktrf.dll
Adware:adware/ezula No disinfected C:\WINDOWS\SYSTEM32\ezPopStub.exe
Spyware:spyware/linkreplacer No disinfected C:\WINDOWS\SYSTEM32\lmdv.bin
Adware:adware/portalscan No disinfected C:\WINDOWS\SYSTEM32\winupdt.bin
Adware:adware/broadcastpc No disinfected C:\PROGRAM FILES\COMMON FILES\JAVA\bpt.cfg
Adware:adware/ipinsight No disinfected C:\WINDOWS\INF\polall1r.inf
Adware:adware/ncase No disinfected C:\WINDOWS\180ax.log
Adware:adware/exact.bargainbuddyNo disinfected C:\WINDOWS\msxct1.ini
Adware:adware/upspiralbar No disinfected C:\WINDOWS\unist2.exe
Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\InetGet
Adware:adware/dealhelper No disinfected C:\WINDOWS\SYSTEM32\DealHelper
Adware:adware/delfinmedia No disinfected C:\WINDOWS\SYSTEM32\picsvr
Adware:adware/elitebar No disinfected C:\Documents and Settings\dad\Favorites\Casino & Carrers
Adware:adware/tvmedia No disinfected C:\WINDOWS\bundles
Adware:adware/addestroyer No disinfected C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AdDestroyer
Adware:adware/topconvert No disinfected Windows Registry
Dialer:dialer generic No disinfected HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
Adware:adware/wintools No disinfected Windows Registry
Adware:Adware/Imibar No disinfected C:\Documents and Settings\Administrator\Desktop\backups\backup-20051019-185925-728.dll
Adware:Adware/Maxifiles No disinfected C:\Documents and Settings\CHELSEA\Desktop\aimfix_quarantine\1940_mc-110-12-0000080.exe.bak
Adware:Adware/BroadcastPC No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\73.exe\73.exe
Adware:Adware/AdLogix No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\adlinstallwin32.exe
Adware:Adware/WinTools No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\temp.fr2480\toolbar.dll
Adware:Adware/Apropos No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\temp.fr6CB9\ProxyStub.dll
Adware:Adware/Apropos No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\temp.fr859A
Adware:Adware/IPInsight No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\THI1910.tmp\farmmext.ini
Adware:Adware/IPInsight No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\THI4F7B.tmp\farmmext.ini
Adware:Adware/IPInsight No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\THI50C8.tmp\farmmext.ini
Adware:Adware/DelFinMedia No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\uppicsvr.exe
Adware:Adware/DelFinMedia No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temp\vmstmp\vmstmp.exe
Adware:Adware/Exact.BargainBuddyNo disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\CLUZK9IF\casino[1].bmp
Adware:Adware/Exact.BargainBuddyNo disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\ORVF60T1\virus[1].bmp
Adware:Adware/Exact.BargainBuddyNo disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\ZQWNN5OT\dating[1].bmp
Adware:Adware/Maxifiles No disinfected C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\ZQWNN5OT\dnscatcher[1].exe
Adware:Adware/Maxifiles No disinfected C:\Documents and Settings\CHELSEA\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet2\mc-110-12-0000080.exe
Adware:Adware/BroadcastPC No disinfected C:\Program Files\Common Files\Java\bpt.cfg
Adware:Adware/Maxifiles No disinfected C:\RECYCLER\S-1-5-21-436374069-706699826-1202660629-500\Dc1\cwebpage.dll
Adware:Adware/eZula No disinfected C:\WINDOWS\bundles\ezStub_ropwo.exe.tcf
Adware:Adware/AdLogix No disinfected C:\WINDOWS\bundles\shopinst.exe
Adware:Adware/AdLogix No disinfected C:\WINDOWS\bundles\videoinst.exe
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\bundles\wrapperouter.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\inf\polall1r.inf
Adware:Adware/Beginto No disinfected C:\WINDOWS\system32\dsktrf.dll
Possible Virus. No disinfected C:\WINDOWS\system32\ezPopStub.exe
Spyware:Spyware/LinkReplacer No disinfected C:\WINDOWS\system32\uninst.exe
Adware:Adware/EliteBar No disinfected C:\WINDOWS\Temp\k_5434.tmp
Adware:Adware/EliteBar No disinfected C:\WINDOWS\Temp\k_9149.tmp
Spyware:Spyware/ShopNav No disinfected C:\WINDOWS\unist2.exe
And the Hijack This log
Logfile of HijackThis v1.99.1
Scan saved at 10:09:07 PM, on 10/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoctrl.exe
C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\dad\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKLM\..\Run: [Keyboard Driver (do not remove)] AMSNMGR.EXE
O4 - HKLM\..\RunServices: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Keyboard Driver (do not remove)] AMSNMGR.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Thanks again
  • 0

#5
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4
[-HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}]


Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

Check and fix these in HijackThis:

O4 - HKLM\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKLM\..\Run: [Keyboard Driver (do not remove)] AMSNMGR.EXE
O4 - HKLM\..\RunServices: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\Run: [Outlook Mail Services] outlook-express.exe
O4 - HKCU\..\RunOnce: [Keyboard Driver (do not remove)] AMSNMGR.EXE


Delete these files if found:

outlook-express.exe
AMSNMGR.EXE


Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Right click and copy the below lines. Go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say Yes:

C:\Documents and Settings\Administrator\Desktop\backups\backup-20051019-185925-728.dll
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AdDestroyer
C:\Documents and Settings\CHELSEA\Desktop\aimfix_quarantine\1940_mc-110-12-0000080.exe.bak
C:\Documents and Settings\CHELSEA\Local Settings\Temp\73.exe\73.exe
C:\Documents and Settings\CHELSEA\Local Settings\Temp\adlinstallwin32.exe
C:\Documents and Settings\CHELSEA\Local Settings\Temp\temp.fr2480\toolbar.dll
C:\Documents and Settings\CHELSEA\Local Settings\Temp\temp.fr6CB9\ProxyStub.dll
C:\Documents and Settings\CHELSEA\Local Settings\Temp\temp.fr859A
C:\Documents and Settings\CHELSEA\Local Settings\Temp\THI1910.tmp\farmmext.ini
C:\Documents and Settings\CHELSEA\Local Settings\Temp\THI4F7B.tmp\farmmext.ini
C:\Documents and Settings\CHELSEA\Local Settings\Temp\THI50C8.tmp\farmmext.ini
C:\Documents and Settings\CHELSEA\Local Settings\Temp\uppicsvr.exe
C:\Documents and Settings\CHELSEA\Local Settings\Temp\vmstmp\vmstmp.exe
C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\CLUZK9IF\casino[1].bmp
C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\ORVF60T1\virus[1].bmp
C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\ZQWNN5OT\dating[1].bmp
C:\Documents and Settings\CHELSEA\Local Settings\Temporary Internet Files\Content.IE5\ZQWNN5OT\dnscatcher[1].exe
C:\Documents and Settings\CHELSEA\mc-110-12-0000080.exe
C:\Documents and Settings\dad\Favorites\Casino & Carrers
C:\PROGRAM FILES\COMMON FILES\InetGet
C:\PROGRAM FILES\COMMON FILES\InetGet2
C:\Program Files\Common Files\InetGet2\mc-110-12-0000080.exe
C:\Program Files\Common Files\Java\bpt.cfg
C:\RECYCLER\S-1-5-21-436374069-706699826-1202660629-500\Dc1\cwebpage.dll
C:\WINDOWS\180ax.log
C:\WINDOWS\bundles
C:\WINDOWS\bundles\ezStub_ropwo.exe.tcf
C:\WINDOWS\bundles\shopinst.exe
C:\WINDOWS\bundles\videoinst.exe
C:\WINDOWS\bundles\wrapperouter.exe
C:\WINDOWS\inf\polall1r.inf
C:\WINDOWS\msxct1.ini
C:\WINDOWS\SYSTEM32\DealHelper
C:\WINDOWS\system32\dsktrf.dll
C:\WINDOWS\system32\ezPopStub.exe
C:\WINDOWS\SYSTEM32\lmdv.bin
C:\WINDOWS\SYSTEM32\picsvr
C:\WINDOWS\system32\uninst.exe
C:\WINDOWS\SYSTEM32\winupdt.bin
C:\WINDOWS\Temp\k_5434.tmp
C:\WINDOWS\Temp\k_9149.tmp
C:\WINDOWS\unist2.exe


If you get a PendingOperations message, just close it and restart your computer manually.


Restart...

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

Run the Panda scan again. Post the log here along with a new HijackThis log.
  • 0

#6
balddog

balddog

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
The actice scan log:

Incident Status Location

Adware:adware/portalscan No disinfected C:\WINDOWS\BUNDLES\58kd52fg.exe
Adware:adware/ncase No disinfected C:\WINDOWS\180axau.dat
Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\InetGet2
Adware:adware/beginto No disinfected C:\WINDOWS\SYSTEM32\cache32_dsktptr
Adware:adware/dealhelper No disinfected C:\WINDOWS\SYSTEM32\Newmsrdk
Adware:adware/elitebar No disinfected C:\Documents and Settings\dad\Favorites\Casino & Carrers
Adware:adware/tvmedia No disinfected C:\WINDOWS\bundles
Adware:adware/addestroyer No disinfected C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AdDestroyer
Adware:adware/delfinmedia No disinfected C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\picsvr
Adware:adware/topconvert No disinfected Windows Registry
Dialer:dialer generic No disinfected HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
Adware:adware/wintools No disinfected Windows Registry
Virus:Bck/Foobar.B Disinfected C:\Documents and Settings\CHELSEA\tit.exe


Hijck log:

Logfile of HijackThis v1.99.1
Scan saved at 7:00:38 AM, on 10/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoctrl.exe
C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe
C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
C:\Documents and Settings\dad\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\CHELSEA\Desktop\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

thanks much for your time and effort for me
balddog
  • 0

#7
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4
[-HKEY_CLASSES_ROOT\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}]


Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.


Delete these files/folders if still found:

C:\WINDOWS\180axau.dat
C:\PROGRAM FILES\COMMON FILES\InetGet2
C:\WINDOWS\SYSTEM32\cache32_dsktptr
C:\WINDOWS\SYSTEM32\Newmsrdk
C:\Documents and Settings\dad\Favorites\Casino & Carrers
C:\WINDOWS\bundles
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AdDestroyer
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\picsvr


Restart and run a new Panda scan. Post the log here.
  • 0

#8
balddog

balddog

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Log as requested below:

Incident Status Location

Adware:adware/ncase Reported C:\WINDOWS\180ax_gdf.dat
Adware:adware/maxifiles Reported C:\PROGRAM FILES\COMMON FILES\Windows
Adware:adware/elitebar Reported C:\Documents and Settings\dad\Favorites\Finances & Business
Adware:adware/topconvert Reported Windows Registry
Dialer:dialer generic Reported HKEY_CLASSES_ROOT\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}
Spyware:Cookie/empnads Reported C:\WINDOWS\system32\config\systemprofile\Cookies\system@empnads[1].txt
Spyware:Cookie/Rn11 Reported C:\WINDOWS\system32\config\systemprofile\Cookies\system@rn11[2].txt
Thanks for your time and efforts once again
balddog
  • 0

#9
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Does Panda have an option to clean out infected files? If so, make sure to check it to enable it to fix whatever it finds.

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4
[-HKEY_CLASSES_ROOT\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}]


Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Right click and copy the below lines. Go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say Yes:

C:\WINDOWS\180ax_gdf.dat
C:\PROGRAM FILES\COMMON FILES\Windows
C:\Documents and Settings\dad\Favorites\Finances & Business
C:\WINDOWS\system32\config\systemprofile\Cookies\system@empnads[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@rn11[2].txt


If you get a PendingOperations message, just close it and restart your computer manually.

Restart and boot into Safe Mode.

Delete these if found:

C:\WINDOWS\180ax_gdf.dat
C:\PROGRAM FILES\COMMON FILES\Windows
C:\Documents and Settings\dad\Favorites\Finances & Business
C:\WINDOWS\system32\config\systemprofile\Cookies\system@empnads[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@rn11[2].txt


While in Safe Mode, run an Ewido scan and save the report.

Restart...

Run a new Panda scan. Post that log here along with the Ewido log.
  • 0

#10
balddog

balddog

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
I did not see an option of removal, 3 items were detected again...I certainly can delete them now they are identified..here are the 2 logs:

Panda:

Incident Status Location

Adware:adware/maxifiles Reported C:\PROGRAM FILES\COMMON FILES\Windows
Adware:adware/elitebar Reported C:\Documents and Settings\dad\Favorites\Health & Insurance
Adware:adware/topconvert Reported Windows Registry
Ewido:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 7:55:54 AM, 10/23/2005
+ Report-Checksum: 5DF2BF93

+ Scan result:

No infected objects found.


::Report End
Thanks
  • 0

#11
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Hmm...they must have changed how it removes viruses then. We'll delete them manually :tazz:

Delete these two folders also:

C:\PROGRAM FILES\COMMON FILES\Windows
C:\Documents and Settings\dad\Favorites\Health & Insurance


Restart and run a new Panda scan. Anything else found besides that registry entry (it's harmless now)? If not, then:

Your log is clean.

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.
  • 0

#12
balddog

balddog

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Thanks very much, I will dump these and double check the Panda software, could be me, which would not be a shocker. My daughter thanks you as well, so now she can get her machine back in her bedroom, and off my machine!!!
Balddog :tazz:
  • 0

#13
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP