Thread: Aurora, Nail, CWS, and more!
View Single Post
Old 10-11-2005, 07:46 AM   #1 (permalink)
Demented Mouse
Registered User
 
Join Date: Oct 2005
Posts: 11
OS: XP home


Aurora, Nail, CWS, and more!
Hello hello. My friend's computer is not doing so well, I've done what I could and I also posted this problem on a completely different forum but they're taking too long to get back to me and also a second opinion is good anyway. Here's my HijackThis log and also they told me to download a program called Ewido and post a log so that's included, skip over it if you don't care, you're the experts. A few trojans that I think I've taken care of but I was also a victim of Aurora and Nail.exe and also there's a lot of coolwebsearch. Also included at the end of this thread is the HijackThis Analyzer results. If this is too much I apologize.

Thank you very much for your help.

Here goes:

Quote:
Originally Posted by Demented Mouse
I followed all of the instructions in the "Victims of aurora and nail" thread and I'm here to make sure nothing else is terribly wrong with this computer. Here's my current HijackThis log and Ewido log, as instructed. There seems to be a problem with Ewido, however, when I try to get rid of the files after about 4 or 5 Ewido crashes. Thanks for your help.



Logfile of HijackThis v1.99.1
Scan saved at 9:53:57 PM, on 10/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis1991.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Spooler Subsystem] spoolsub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe





---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:51:49 PM, 10/10/2005
+ Report-Checksum: 9F8AA3A9

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{12FA3D1E-6BB1-A968-D251-242CE33A798A} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Classes\CLSID\{65D75D06-7395-6352-09CD-E13B9059EFE9} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{6C69E2F6-F200-55DF-18C6-3C368029FD3E} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{DCF499B3-5BE2-6F3F-B6C8-FB0597F0FF79} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{F2255AF4-092C-0BF6-52CF-8484B194FCC4} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{FC5F30D8-4A16-B1C4-CFF8-EE955DFA16A2} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Ignored
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Ignored
C:\Program Files\Thief - Deadly Shadows\System\t3.exe -> TrojanSpy.Comcast.a : Ignored
C:\RECYCLER\NPROTECT\00102007.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102008.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102087.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102089.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102819.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00104072.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\desktop.ini:xwvpp -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\dsr.exe -> Trojan.Imiserv.c : Ignored
C:\WINDOWS\dvfxgy.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\Greenstone.bmp:cxzxmn -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\ODBC.INI:nrboxx -> Trojan.Agent.bi : Ignored
C:\WINDOWS\Rhododendron.bmp:cflzez -> Trojan.Agent.bi : Ignored
C:\WINDOWS\setupapi.old:yysyp -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\system32:gyaa.dll -> TrojanDownloader.Small.azk : Ignored
C:\WINDOWS\system32\ajzsiic.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\system32\bddyrm.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\system32\elfvkvb.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\system32\ezPopStub.exe -> Adware.EZula : Ignored
C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Ignored
C:\WINDOWS\system32\in10tvmk37s.dll -> TrojanDropper.Small.abd : Ignored
C:\WINDOWS\system32\megaV2wbr.dll -> TrojanDropper.Small.xm : Ignored
C:\WINDOWS\system32\oleext.dll -> Trojan.Small.ev : Ignored
C:\WINDOWS\ucmoreiex.exe/UCMTSAIE.DLL -> Spyware.UCmore : Ignored
C:\WINDOWS\ucmoreiex.exe/IUCMORE.DLL -> Spyware.UCmore : Ignored
C:\WINDOWS\UPGRADE.TXT:apgco -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\vb.ini:cwehl -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\x74ca5e40.tmp:rcckgg -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default(2).pif:itkmn -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default(2).pif:jzelpl -> Spyware.SearchPage : Ignored
C:\WINDOWS\_default(2).pif:kcnpiq -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default(2).pif:oqchur -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:dwxyis -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:fqplk -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:gxhtni -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:ijdevu -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default.pif:itkmn -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:iwwdke -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default.pif:jzelpl -> Spyware.SearchPage : Ignored
C:\WINDOWS\_default.pif:kcnpiq -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:nxpntg -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default.pif:oqchur -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:qzudnx -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:uuhar -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:wagkt -> TrojanDownloader.Agent.bc : Ignored


::Report End


KRC HijackThis log Analyzer

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 9/28/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 9:53:57 PM, on 10/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\HJT\HijackThis1991.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [Spooler Subsystem] spoolsub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


End of KRC HijackThis Analyzer Log.
====================================================================
Demented Mouse is offline  
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here