Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

SurfSidekick, Aurora, and Trojans [RESOLVED]

Started by runner , Aug 27 2005 02:38 PM

  • This topic is locked This topic is locked

#76
runner
Posted 29 September 2005 - 11:46 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
OK, I went back through your two posts and wrote down the web addresses for the downloads. I printed the instructions, and will try to get to the downloads by directly inserting the addresses in. I hope I am able to get them before I am kicked off the internet!!

In which order should I go - your last post first, or start with the one before?

Thanks, and sorry for the rambling last post!
  • 0

Advertisements

#77
tampabelle
Posted 30 September 2005 - 07:06 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Hi runner,


most of the times, the fixes or the instructions we give will not do any harm to your PC or any settings.

However always proceed with the latest set of instructions and report back. That way we minimize the confusion as to which set of instructions you have done.
  • 0

#78
runner
Posted 30 September 2005 - 07:34 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
Sorry, I did both sets before I read your post.:tazz:

The good news is that things in general appear to be running more smoothly. The bad news is that I am still having problems with the internet on the infected computer. I still get the Yahoo Browser has encountered an error and needs to close message a lot, and I still cannot get to the forums on geeks to go or to the symantec page to update Norton definitions (I tried Live Update, too - no luck).

Anyway, I was able to proceed through all steps with no problems except one: Color me an idiot (again!), but I have no clue how to take the steps with respect to my Firewall that you suggested.

Also, I should add, I think I may have discovered at least the problem that was causing Task Manager not to work - dont know if it is related to internet problems, but this is from an Ad-Aware scan this morning:

Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Windows Object Recognized!
Type : RegData
Data :
TAC Rating : 3
Category : Vulnerability
Comment : Possible unintended lockout from Task Manager (Task manager access disabled)
Rootkey : HKEY_USERS
Object : S-1-5-21-541998944-2676829564-3386067161-1006\software\microsoft\windows\currentversion\policies\system
Value : DisableTaskMgr
Data :
____________________________________________________________________

Here the logs are, and thanks again for your help!!

LOGS FROM FOLLOWING INSTRUCTIONS IN 1ST POST:

Ewido:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 12:38:01 AM, 9/30/2005
+ Report-Checksum: 4819F77B

+ Scan result:

C:\Documents and Settings\Laura\Cookies\laura@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup


::Report End

RK Files:

C:\Documents and Settings\Laura\Desktop\rkfiles

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/18/2005 9:06:10 PM 58 C:\windows.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 170053 C:\WINDOWS\tsc.exe
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 8/7/2005 6:14:48 PM 1044560 C:\WINDOWS\vsapi32.dll
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: UPX! 1/13/2005 9:41:48 PM 11254 C:\WINDOWS\SYSTEM32\locate.com
C:\WINDOWS\SYSTEM32\locate.com: WAUPX!
C:\WINDOWS\SYSTEM32\mscom32.dll: UPX!
C:\WINDOWS\SYSTEM32\DFRG.MSC: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:48 PM 767 C:\log.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/18/2005 9:06:42 PM 228 C:\win.txt
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:12 PM 193869 C:\WINDOWS\Dhnedemq.gty
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 10/31/2004 3:01:00 PM 184535 C:\WINDOWS\Qlhcwllk.xjx
C:\WINDOWS\SYSTEM32\dtALIEN_K_1909.htl: PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
C:\WINDOWS\Dhnedemq.gty: geocities.com/opspec22/index.html
C:\WINDOWS\Qlhcwllk.xjx: geocities.com/opspec22/index.html

Files Found in all users startup Folder............
------------------------
Files Found in all users windows Folder............
------------------------
C:\WINDOWS\dvpd.dll: UPX!
C:\WINDOWS\RMAgentOutput.dll: UPX!
C:\WINDOWS\tsc.exe: UPX!
C:\WINDOWS\vsapi32.dll: UPX!t4
Finished
bye

Fresh HiJack This:

Logfile of HijackThis v1.99.1
Scan saved at 1:20:18 AM, on 9/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\keyhook.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\SYSTEM32\sistray.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\SYSTEM32\sistray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123635234166
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax3209.cab
O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

LOGS FROM FOLLOWING INSTRUCTIONS IN 2ND POST:

Ewido:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:00:34 AM, 9/30/2005
+ Report-Checksum: BA8BDA32

+ Scan result:

No infected objects found.


::Report End

Fresh HiJack This:

Logfile of HijackThis v1.99.1
Scan saved at 8:07:05 AM, on 9/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\keyhook.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\SYSTEM32\sistray.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\SYSTEM32\sistray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123635234166
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax3209.cab
O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

Edited by runner, 13 October 2005 - 09:15 AM.

  • 0

#79
runner
Posted 30 September 2005 - 07:36 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
Shoot, I forgot to add:

From following instructions in first post, the following files did not appear for the Right click on start, explore, and delete step:

C:\WINDOWS\System32\vxgamet1.exe
C:\WINDOWS\System32\vxgamet1.exe
C:\WINDOWS\System32\vxgamet2.exe
C:\WINDOWS\System32\vxgamet2.exe
C:\WINDOWS\System32\vxgamet3.exe
C:\WINDOWS\System32\vxgamet3.exe
  • 0

#80
tampabelle
Posted 30 September 2005 - 08:05 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
  • First, download HSFix from here
  • After it is downloaded, create a new folder on your desktop called "HSFix" and extract all the files into the newly created folder.
  • Next, download CleanUp! Install it, but do not run it yet.
  • Boot into safe mode: Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.
  • Locate the HSFix folder on your desktop, open it, and double-click "hsfix.bat"
  • A log will be produced which you can close out of.
  • Then run HijackThis again, close any open windows and browsers and fix these:
    O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll
  • Run CleanUp! and let it clean your computer of temp files. Decline when it asks you to log off.
  • Restart your computer into normal mode and run at least one of the following free, online virus scans:
    http://housecall.tre.../start_corp.asp
    http://www.pandasoft...n_principal.htm
    http://www3.ca.com/t...sinfo/scan.aspx
  • Restart your computer one last time and post a new HijackThis log, as well as the HSFix log which is located at C:/hslog.txt

  • 0

#81
runner
Posted 30 September 2005 - 08:41 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
Great, thanks! The only issue I might have is running an online scan from the infected PC. I have tried to do so previously and I get the error message saying Yahoo Browser has encountered an error and has to close.

I will not be able to get to this until later this afternoon/early evening. Thanks again!
  • 0

#82
tampabelle
Posted 30 September 2005 - 11:29 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
no problem runner !!!

Post back the logs when done.
  • 0

#83
runner
Posted 03 October 2005 - 07:08 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
Sorry, I would have posted this earlier, but despite all steps being executed without a problem, I am still being kicked off the internet every so often and still cannot get to symantec or GTG in order to post from the infected PC. I noticed that even though I deleted the one entry from HiJack This while in safe mode (immediately after running HSFixer), it returned when I ran HiJack This on reboot.

I was able to run 2 of the 3 scans you suggested. For Housecall, I kept getting kicked off the internete mid-scan. Both picked up things - some were fixed, some were not (I am sorry, I did not save the logs).

On the bright side, I was able to fix notepad (us technologically defunct people get excited about things like this!!)!!

Anyway, thanks again for your time and effort! Here are the logs you requested:

Hslog:

Horseserver Removal Tool v1.05
by Atri
-
-
1. Registry Fix Started
-
Registry fix complete
-
2. Deleted Services
-
-
3. Finding files Located on system
-
ps.a3d
-
4. Deleting files that were found.
-
-
5. Checking for and Removing Winupdate
-
-
-

Here is HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 12:21:12 AM, on 10/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\keyhook.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SYSTEM32\sistray.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\SYSTEM32\sistray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123635234166
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/s...nfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.co...snmusax3209.cab
O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

Edited by runner, 13 October 2005 - 09:16 AM.

  • 0

#84
tampabelle
Posted 03 October 2005 - 06:07 PM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Please download this file:
LINK REMOVED --- SWANDOG46

Unzip it to a folder, make sure you unzip all of the files. After you unzip it reboot in Safe mode.

Once in Safe mode go to the folder and double click on RunThis.bat.

A DOS window will open, just follow the instructions.

Edited by Swandog46, 03 October 2005 - 07:18 PM.

  • 0

#85
Swandog46
Posted 03 October 2005 - 07:19 PM

Swandog46

    Malware Expert

  • Member
  • PipPipPipPip
  • 1,026 posts
  • MVP
runner, please do NOT execute the file from the post above! It is in beta, and there is a MAJOR potential bug in it that needs to be corrected! Thank you.
  • 0

Advertisements

#86
runner
Posted 04 October 2005 - 05:34 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
OK, thanks for the heads up. I will just await further instruction. Thanks again!
  • 0

#87
tampabelle
Posted 04 October 2005 - 11:50 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Hi runner,

download & run http://www.sysintern...itRevealer.html
save it's log and post back with the log

DO NOT attempt to fix anything it finds as most entries will be legitimate
  • 0

#88
runner
Posted 04 October 2005 - 12:15 PM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
Thanks, I will do so later this afternoon. I assume that since I am fixing nothing, I still will be prevented from getting back to this thread, so my next post might not be til tomorrow. Thanks for the help!
  • 0

#89
runner
Posted 05 October 2005 - 07:06 AM

runner

    Member

  • Topic Starter
  • Member
  • PipPip
  • 86 posts
OK, the rootkit log is below.

HKLM\SOFTWARE\C5iR5AH6ggpm 9/19/2005 7:40 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_ULTRA 5/25/2004 2:23 AM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_USBMTV4 8/27/2005 11:06 AM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet003\Services\usbhub 10/4/2005 7:19 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet003\Services\usbmTV4 10/4/2005 7:19 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Log.LiveUpdate.bak 10/4/2005 7:27 PM 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Common Files\Symantec Shared\SymcData\ids-diskless\lulock.dat 10/4/2005 7:43 PM 0 bytes Hidden from Windows API.
C:\Program Files\Common Files\Symantec Shared\SymcData\ids-diskless\tmp4253.tmp 10/4/2005 7:43 PM 0 bytes Hidden from Windows API.
C:\Program Files\Common Files\Symantec Shared\SymcData\ids-diskless\tmp920.tmp 10/4/2005 7:43 PM 0 bytes Hidden from Windows API.
C:\Program Files\Common Files\Symantec Shared\VirusDefs\lulock.dat 10/4/2005 7:43 PM 0 bytes Hidden from Windows API.
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmp4277.tmp 10/4/2005 7:43 PM 0 bytes Hidden from Windows API.
C:\Program Files\Common Files\Symantec Shared\VirusDefs\tmp56f8.tmp 10/4/2005 7:43 PM 0 bytes Hidden from Windows API.
C:\Program Files\Intrlink 10/4/2005 7:19 PM 0 bytes Hidden from Windows API.
C:\Program Files\Intrlink\ace.dll 8/27/2005 11:06 AM 568.00 KB Hidden from Windows API.
C:\Program Files\Intrlink\AI_01-10-2005.log 10/1/2005 12:01 AM 3 bytes Hidden from Windows API.
C:\Program Files\Intrlink\AI_03-10-2005.log 10/3/2005 7:37 AM 3 bytes Hidden from Windows API.
C:\Program Files\Intrlink\AI_04-10-2005.log 10/4/2005 7:19 PM 3 bytes Hidden from Windows API.
C:\Program Files\Intrlink\AI_28-09-2005.log 9/28/2005 12:35 AM 3 bytes Hidden from Windows API.
C:\Program Files\Intrlink\AI_29-09-2005.log 9/29/2005 12:00 AM 3 bytes Hidden from Windows API.
C:\Program Files\Intrlink\AI_30-09-2005.log 9/30/2005 1:16 AM 3 bytes Hidden from Windows API.
C:\Program Files\Intrlink\atl.dll 8/27/2005 11:06 AM 73.06 KB Hidden from Windows API.
C:\Program Files\Intrlink\Cache 8/27/2005 11:06 AM 0 bytes Hidden from Windows API.
C:\Program Files\Intrlink\data.bin 8/27/2005 11:06 AM 114.14 KB Hidden from Windows API.
C:\Program Files\Intrlink\ddrdx7vb.exe 8/27/2005 11:06 AM 156.00 KB Hidden from Windows API.
C:\Program Files\Intrlink\WinGenerics.dll 8/27/2005 11:06 AM 560.00 KB Hidden from Windows API.
C:\Program Files\Intrlink\xacrsm.exe 8/27/2005 11:06 AM 908.00 KB Hidden from Windows API.
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 10/4/2005 7:21 PM 64.00 KB Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\SYSTEM32\avpu32.dll 9/28/2005 6:43 PM 36.88 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\avpu32.sys 9/28/2005 6:43 PM 4.00 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\avpu64.sys 9/28/2005 6:43 PM 19.48 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\DRIVERS\amsb80239.sys 8/27/2005 11:06 AM 12.00 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\klogini.dll 9/28/2005 6:43 PM 0 bytes Hidden from Windows API.
C:\WINDOWS\SYSTEM32\p3.ini 9/28/2005 6:43 PM 320 bytes Hidden from Windows API.
C:\WINDOWS\SYSTEM32\qy.sys 9/28/2005 6:43 PM 4.00 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\qz.dll 9/28/2005 6:43 PM 36.88 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\qz.sys 9/28/2005 6:43 PM 19.48 KB Hidden from Windows API.
C:\WINDOWS\SYSTEM32\vbsatson.exe 9/30/2005 12:40 AM 424.00 KB Hidden from Windows API.
  • 0

#90
tampabelle
Posted 05 October 2005 - 11:02 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Hi,

Yes you have the Haxdoor infection. The tool HSfix is supposed to address that infection.

Can you tell me about the folder C:\Program Files\Intrlink ?? I have separated the files associated with Intrlink. Do not delete them if you want the program. I didnt like what I saw on the net regarding Intrlink and some of the file slisted there are bad files. We can address the bad files individually next time around, if you want the software.
  • Please open notepad and save these instructions, Name it something you will remember
  • Click Here to download Killbox by Option^Explicit.
  • Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
  • In the killbox program, select the Delete on Reboot option.
  • Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

    C:\WINDOWS\Dhnedemq.gty
    C:\WINDOWS\Qlhcwllk.xjx
    C:\WINDOWS\dvpd.dll
    C:\WINDOWS\RMAgentOutput.dll
    C:\WINDOWS\SYSTEM32\avpu32.dll
    C:\WINDOWS\SYSTEM32\avpu32.sys
    C:\WINDOWS\SYSTEM32\avpu64.sys
    C:\WINDOWS\SYSTEM32\DRIVERS\amsb80239.sys
    C:\WINDOWS\SYSTEM32\klogini.dll
    C:\WINDOWS\SYSTEM32\p3.ini
    C:\WINDOWS\SYSTEM32\qy.sys
    C:\WINDOWS\SYSTEM32\qz.dll
    C:\WINDOWS\SYSTEM32\qz.sys
    C:\WINDOWS\SYSTEM32\vbsatson.exe


    C:\Program Files\Intrlink
    C:\Program Files\Intrlink\ace.dll
    C:\Program Files\Intrlink\AI_01-10-2005.log
    C:\Program Files\Intrlink\AI_03-10-2005.log
    C:\Program Files\Intrlink\AI_04-10-2005.log
    C:\Program Files\Intrlink\AI_28-09-2005.log
    C:\Program Files\Intrlink\AI_29-09-2005.log
    C:\Program Files\Intrlink\AI_30-09-2005.log
    C:\Program Files\Intrlink\atl.dll
    C:\Program Files\Intrlink\Cache
    C:\Program Files\Intrlink\data.bin
    C:\Program Files\Intrlink\ddrdx7vb.exe
    C:\Program Files\Intrlink\WinGenerics.dll
    C:\Program Files\Intrlink\xacrsm.exe

  • Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
  • Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
Your computer should restart automatically if not please restart manually please post back a fresh HJT log and a fresh rootkitrevealer log
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP