Did a Full Norton scan- but told I have a virus

originale · 12-20-2004, 11:48 AM

I updated my Norton on Saturday- ran a full scan yesterday and quarantined a Trojan. Sent out an email- no attachment= and one of the recipients emailed back and said her computer said my email contained a virus. How can that be possible? And also, how can an email without an attachment contain a virus?

thanks

deborah

**Detah** · 12-20-2004, 01:53 PM

1) It is possible that you have a virus/trojan and your antivirus program is not aware of that version of the bug yet. A virusscanner is only as good as its latest virus definitions list. And just because you have the most recent list, does not mean that it includes every bug that exists. So yes, it is possible that you have a virus and your virusscanner shows that you are clean.

2) That user who received your email may have a virusscanner built into the mail server that he/she uses. Your virus may have added an attachment to your outgoing email without your knowing it. Then your friend's mail server received the email, it scanned it, identified (correctly or not) the attachment as a bug and removed the attachment. This is common with server side antivirus programs. So yes, it is possible that she received a message of receiving a virus and you didn't know there was an attachment.

3) Lets check out your machine. Please post a HiJackThis log in a new thread of the HJT log section of this forum and I or someone will analyze it for you.

HijackThis instructions (~157kB)

Download HiJackThis v1.99 (written by Merijn Bellekom) from
http://www.spywareinfo.com/~merijn/downloads.html
Save HijackThis.exe into its own permanent directory, NOT in a TEMPorary folder or on the DESKTOP. Temporary folders get cleaned out periodically and are often destinations for viruses and spyware. So you don't want it there. If you place HJT on the Desktop, then all of your logs and backups will get spread out over the desktop. That is not efficient. For simplicity, I recommend c:/program files/HJT/
Important: Close all windows/programs, internet connections and especially internet browsers before scanning and fixing with HJT.
Doubleclick HijackThis.exe. Config | Misc Tools | Check for update online, save into your permanent directory. If you find a new version, then close HJT. Unzip into permanent directory. Replace file=Yes.
Doubleclick HijackThis.exe. Press the <Scan> button
DO NOT FIX ANYTHING YET!! Most of the entries found in a HiJackThis scan are programs/files which are REQUIRED for your computer to operate normally.
Press the <Save Log> button and save into your HJT folder. Change the file name to HJT 9-22-04a.log or some similar dating nomenclature so you can identify each log
The log should automatically open in Notepad. If not, open the log file from any text editor (Notepad, MS Word, Word Perfect, etc)
Copy/paste the results here in this forum and let an expert evaluate it for you.
Close HiJackThis//

crazijoe · 12-20-2004, 02:13 PM

In addition to what Detah has said, someone could have hijacked your contacts, spoofed your email address and emailed the virus to your friend.

originale · 12-21-2004, 09:42 PM

Here is the HJT log. I double-clicked but cdn't figure out how to get an updated version-not sure what you meant by: Doubleclick HijackThis.exe. Config | Misc Tools | Check for update online, save into your permanent directory. If you find a new version, then close HJT. Unzip into permanent directory. Replace file=Yes. It never took me to that.

so here it is. Thanks a lot for the help.

Logfile of HijackThis v1.99.0
Scan saved at 11:38:20 PM, on 12/21/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\Connected\CBSysTray.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\Program Files\Connected\AgentSrv.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_20_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_20_0.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://groups.msn.com
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0167169d...p/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.9.27.1/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O23 - Service: Connected Agent Service - Connected Corporation - c:\Program Files\Connected\AgentSrv.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: NICSer_WPC54 - Unknown - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

MicroBell · 12-22-2004, 02:04 AM

This log is clean. Don't see any suspious files or a trojan running. Maybe that e-mail didn't come from you? Have them check the message headers and see if it came through your ISP and POP3 server. Lets look a little deeper in your system to make sure.

Download: StartDreck

Unzip to its own folder and start the program:
Press 'Config'
Press 'Mark All'

UN-Check the 'NT-Services & NT-Kernel...' boxes only:
Press 'Ok'

Press 'Save' and select the location to save the log file (default is the same folder as the application)

Post the log in this thread

originale · 12-28-2004, 07:59 AM

Can't run Dreck- keep on getting unresponsive dialogue box and it's just dead. Not sure why.

**Detah** · 12-28-2004, 09:40 AM

Lets clean up some of the clutter and make sure you have Spybot and AdAware configured correctly.

To show hidden files instructions
Doubleclick My Computer | Tools | Folder Options | View tab
Select Show Hidden Files and Folders
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files (Recommended)
Select Apply to All Folders | Yes | Apply | OK
----------------------------------------------------------------
Turn off System Restore instructions
Rightclick My Computer | Properties | System Restore | check “Turn off System Restore”, <Apply>, <OK>. Reboot.
After we are finished with your log file and verified that it’s clean, you may turn it back on and create a new restore point.
----------------------------------------------------------------
Reboot in Safe Mode instructions. During reboot, tap the F8 key. Select Safe Mode.
----------------------------------------------------------------
Open HiJackThis | Scan,
Put a check next to the following items.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/.../search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
O15 - Trusted Zone: http://groups.msn.com
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.co...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0167169...ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.9.27.1/ttinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tec...ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tec.../ActiveData.cab

Confirm that you have only the ones above checked, then press <Fix checked>
Close HJT
----------------------------------------------------------------
* Empty your c:/windows/temp folder. Note: only empty the contents of the folder, leave the folder there.
* Empty your C:\Documents and Settings\LocalService\Local Settings\Temp
* Empty your C:\Documents and Settings\<All other usernames including Default User and Administrator>\Local Settings\Temp
* Now empty your Recycle Bin.
* Reboot in Normal Mode.
----------------------------------------------------------------
You should run an online virus scan. Select one or more of the following. Online virus scans can be superior to PC scans because some malware can infect your PC virus scanner. Select Autoclean if you use TrendMicro's Housecall.
Panda at http://www.pandasoftware.com/actives..._principal.htm
Housecall at http://housecall.trendmicro.com/
RAV Antivirus at http://www.ravantivirus.com/scan
Reboot.
----------------------------------------------------------------
I see you have Spybot installed. Excellent. This is a great tool for getting the badguys. Please check for updates, make sure Immunize is enabled, and run it now. I have provided the full install instructions for Spybot below. You do not need to redownload it if you have the newest version; please confirm that you have everything configured correctly.

I cannot tell from your log whether you have AdAware. Please download, install, update, configure and run it now.

Here are two essential anti-spyware programs which you should run regularly. Updates for these programs come out weekly. Run them now.

Spybot Search & Destroy instructions (~3.5MB)

Download Spybot (written by Patrick Kolla). Click <download> from
http://www.safer-networking.org/
Save spybotsd13.exe into its own directory, NOT in a TEMPorary folder or on the Desktop.
I recommend c:/program files/spybot/
Doubleclick spybotsd13.exe. Make sure to direct the program to install in the c:/program files/spybot/ directory, NOT the default directory.
Open Spybot from Start | Programs | Spybot | Spybot S&D
Select <Search for Updates>. Let it install all updates. This is very important!
Select <Immunize>
Select <Check for Problems>
Check all entries that are in RED. Only RED, NOTHING ELSE. For your records, write/print out each item that you have fixed. Date it.
Select <Fix Selected Problems>
Close Spybot//

Ad-Aware instructions (2563 kB)

Download Ad-Aware SE build 1.05 (written by Lavasoft) from
http://www.lavasoft.de/
If you have a previous version of AdAware installed, you will be prompted to uninstall or keep the older version during installation. Be sure to choose Uninstall The Previous Version. Save aawsepersonal.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/Adaware/
Doubleclick aawsepersonal.exe. Make sure to direct the program to install in the c:/program files/adaware/ directory, NOT the default directory.
Open AdAware from Start | Programs | Lavasoft | AdAware.
Select <Check for updates now>, <Proceed>
Setting adjustments. [[Green = checked]] Click the Gear Icon in the top right corner. New settings:
- By default you begin in the <General> section. The following should be checked:
  - Automatically save logfile
  - Automatically quarantine objects prior to removal
  - Safe Mode (always request confirmation)
  - Prompt to update outdated confirmation - change to "7 days"
- Click <Scanning>
  - Check Scan within Archives
  - Select "Select drives & folders to scan", check all of your harddrives. Usually its just c:/, <Proceed>
  - Under Memory & Registry, select all options
- Click <Advanced>
  - Under Shell Integration, select "Move deleted files to Recycle Bin"
  - Under Logfile detail, select all options
- Click <Defaults>
  - Type in the full URL of what you want as your default homepage and search page eg. http://www.google.com
- Click <Tweak>
  - Expand Scanning Engine and make sure the following are selected:
    - Unload recognized processes during scanning
    - Obtain command line of scanned processes
    - Scan registry for all users instead of current user only
  - Expand Cleaning Engine and make sure the following are selected:
    - Always try to unload modules before deletion
    - During removal, unload explorer and IE if necessary
    - Let Windows remove files in use at next reboot
    - Delete quarantined objects after restoring
  - Expand Safety Settings and make sure the following are selected:
    - Write-protect system files after repair (Hosts file, etc)
Click <Proceed> | <Start> | select Use custom scanning options | <Next>
When the scan is finished, rightclick on any entry and choose <Select All Objects>.
Select <Clean>
Close AdAware//

----------------------------------------------------------------
Reboot and post a fresh HiJackThis log.

originale · 12-28-2004, 08:00 PM

Hi Detah: I've begun doing what you recommended and I'm sure you wouldn't tell me to do something that will make things worse but..... when I was going to uncheck Hide Protected operating system files it warned me it cd make the system inoperable.

What are the risks with the steps you have recommended I take. What happens if safe operating mode doesn't work?

BTW- have Ad aware SE and Spybot.

Thanks

MicroBell · 12-28-2004, 10:03 PM

Quote:

Originally Posted by originale

Hi Detah: I've begun doing what you recommended and I'm sure you wouldn't tell me to do something that will make things worse but..... when I was going to uncheck Hide Protected operating system files it warned me it cd make the system inoperable.

What are the risks with the steps you have recommended I take. What happens if safe operating mode doesn't work?

BTW- have Ad aware SE and Spybot.

Thanks

The system can become inoperable IF you delete a needed system file...but simply unchecking that option so we can view ALL files and folders is safe. Just don't delete anything without an analyst asking you too!

**Detah** · 12-29-2004, 07:04 AM

Yes. The default setting for WinXP (and most Windows Operating systems) is to have the core operating system files hidden. However, we (and you) need to see them because sometimes the badguys overwrite important files and put them in the wrong place. So it is important that you are able to 'see' all files on your system.

There is no danger of any kind in making them visible. No files are removed with this action and none are added.

WinXP can be tricky to boot into Safe Mode, especially with a fast processor. You need to start tapping the F8 key as soon as you reboot. Tap it gently and frequently. Eventually you will end up with a menu of choices. Choose Safe Mode.

12-20-2004, 11:48 AM	#1 (permalink)
originale Registered User Join Date: Sep 2004 Posts: 441 OS: winXP	Did a Full Norton scan- but told I have a virus I updated my Norton on Saturday- ran a full scan yesterday and quarantined a Trojan. Sent out an email- no attachment= and one of the recipients emailed back and said her computer said my email contained a virus. How can that be possible? And also, how can an email without an attachment contain a virus? thanks deborah

12-20-2004, 01:53 PM	#2 (permalink)
Detah TSF Enthusiast Join Date: Jun 2004 Location: from IL; now in KY Posts: 642 OS: Win98SE/XP My System	1) It is possible that you have a virus/trojan and your antivirus program is not aware of that version of the bug yet. A virusscanner is only as good as its latest virus definitions list. And just because you have the most recent list, does not mean that it includes every bug that exists. So yes, it is possible that you have a virus and your virusscanner shows that you are clean. 2) That user who received your email may have a virusscanner built into the mail server that he/she uses. Your virus may have added an attachment to your outgoing email without your knowing it. Then your friend's mail server received the email, it scanned it, identified (correctly or not) the attachment as a bug and removed the attachment. This is common with server side antivirus programs. So yes, it is possible that she received a message of receiving a virus and you didn't know there was an attachment. 3) Lets check out your machine. Please post a HiJackThis log in a new thread of the HJT log section of this forum and I or someone will analyze it for you. HijackThis instructions (~157kB) Download HiJackThis v1.99 (written by Merijn Bellekom) from http://www.spywareinfo.com/~merijn/downloads.html Save HijackThis.exe into its own permanent directory, NOT in a TEMPorary folder or on the DESKTOP. Temporary folders get cleaned out periodically and are often destinations for viruses and spyware. So you don't want it there. If you place HJT on the Desktop, then all of your logs and backups will get spread out over the desktop. That is not efficient. For simplicity, I recommend c:/program files/HJT/ Important: Close all windows/programs, internet connections and especially internet browsers before scanning and fixing with HJT. Doubleclick HijackThis.exe. Config \| Misc Tools \| Check for update online, save into your permanent directory. If you find a new version, then close HJT. Unzip into permanent directory. Replace file=Yes. Doubleclick HijackThis.exe. Press the <Scan> button DO NOT FIX ANYTHING YET!! Most of the entries found in a HiJackThis scan are programs/files which are REQUIRED for your computer to operate normally. Press the <Save Log> button and save into your HJT folder. Change the file name to HJT 9-22-04a.log or some similar dating nomenclature so you can identify each log The log should automatically open in Notepad. If not, open the log file from any text editor (Notepad, MS Word, Word Perfect, etc) Copy/paste the results here in this forum and let an expert evaluate it for you. Close HiJackThis//

12-20-2004, 02:13 PM	#3 (permalink)
crazijoe Tech Hardware Forums Join Date: Oct 2004 Location: Omaha, The Center of the Universe Posts: 7,632 OS: WinXP, Win2K3 My System	In addition to what Detah has said, someone could have hijacked your contacts, spoofed your email address and emailed the virus to your friend. __________________ Microsoft MCSA + Messaging, MVP, A+, Network+ Do you want a real Republican? HDD diagnostic tools / HDD data recovery software

12-21-2004, 09:42 PM	#4 (permalink)
originale Registered User Join Date: Sep 2004 Posts: 441 OS: winXP	Hijack Log Here is the HJT log. I double-clicked but cdn't figure out how to get an updated version-not sure what you meant by: Doubleclick HijackThis.exe. Config \| Misc Tools \| Check for update online, save into your permanent directory. If you find a new version, then close HJT. Unzip into permanent directory. Replace file=Yes. It never took me to that. so here it is. Thanks a lot for the help. Logfile of HijackThis v1.99.0 Scan saved at 11:38:20 PM, on 12/21/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\S3tray2.exe C:\Program Files\NavNT\vptray.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe C:\Program Files\Connected\CBSysTray.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe c:\Program Files\Connected\AgentSrv.EXE C:\Program Files\NavNT\defwatch.exe C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe C:\Program Files\NavNT\rtvscan.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsgSys.EXE C:\WINDOWS\system32\wscntfy.exe C:\unzipped\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_20_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_20_0.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe O4 - Global Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://groups.msn.com O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0167169d...p/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.9.27.1/ttinst.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab O23 - Service: Connected Agent Service - Connected Corporation - c:\Program Files\Connected\AgentSrv.EXE O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: NICSer_WPC54 - Unknown - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

12-22-2004, 02:04 AM	#5 (permalink)
MicroBell Manager Emeritus - Security Center, Expert Analyst, Moderator - Security Team; Rangemaster, TSF Academy & Supporter Join Date: Sep 2004 Location: Carmichaels, PA-USA Posts: 6,961 OS: Windows XP-Pro SP2	This log is clean. Don't see any suspious files or a trojan running. Maybe that e-mail didn't come from you? Have them check the message headers and see if it came through your ISP and POP3 server. Lets look a little deeper in your system to make sure. Download: StartDreck Unzip to its own folder and start the program: Press 'Config' Press 'Mark All' UN-Check the 'NT-Services & NT-Kernel...' boxes only: Press 'Ok' Press 'Save' and select the location to save the log file (default is the same folder as the application) Post the log in this thread __________________ We Are The BORG Spyware KILLER and Adware Destroyer! Spyware/Adware Removal Tools Hijackthis Ad-aware SE Spybot Search&Destroy SpywareBlaster CWShredder

12-28-2004, 07:59 AM	#6 (permalink)
originale Registered User Join Date: Sep 2004 Posts: 441 OS: winXP	Can't run Dreck- keep on getting unresponsive dialogue box and it's just dead. Not sure why.

12-28-2004, 09:40 AM	#7 (permalink)
Detah TSF Enthusiast Join Date: Jun 2004 Location: from IL; now in KY Posts: 642 OS: Win98SE/XP My System	Lets clean up some of the clutter and make sure you have Spybot and AdAware configured correctly. To show hidden files instructions Doubleclick My Computer \| Tools \| Folder Options \| View tab Select Show Hidden Files and Folders Uncheck Hide extensions for known file types Uncheck Hide protected operating system files (Recommended) Select Apply to All Folders \| Yes \| Apply \| OK ---------------------------------------------------------------- Turn off System Restore instructions Rightclick My Computer \| Properties \| System Restore \| check “Turn off System Restore”, <Apply>, <OK>. Reboot. After we are finished with your log file and verified that it’s clean, you may turn it back on and create a new restore point. ---------------------------------------------------------------- Reboot in Safe Mode instructions. During reboot, tap the F8 key. Select Safe Mode. ---------------------------------------------------------------- Open HiJackThis \| Scan, Put a check next to the following items. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/.../search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/.../search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico O15 - Trusted Zone: http://groups.msn.com O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.co...v45/yacscom.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0167169...ip/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.9.27.1/ttinst.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tec...ta/SymAData.cab O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tec.../ActiveData.cab Confirm that you have only the ones above checked, then press <Fix checked> Close HJT ---------------------------------------------------------------- * Empty your c:/windows/temp folder. Note: only empty the contents of the folder, leave the folder there. * Empty your C:\Documents and Settings\LocalService\Local Settings\Temp * Empty your C:\Documents and Settings\<All other usernames including Default User and Administrator>\Local Settings\Temp * Now empty your Recycle Bin. * Reboot in Normal Mode. ---------------------------------------------------------------- You should run an online virus scan. Select one or more of the following. Online virus scans can be superior to PC scans because some malware can infect your PC virus scanner. Select Autoclean if you use TrendMicro's Housecall. Panda at http://www.pandasoftware.com/actives..._principal.htm Housecall at http://housecall.trendmicro.com/ RAV Antivirus at http://www.ravantivirus.com/scan Reboot. ---------------------------------------------------------------- I see you have Spybot installed. Excellent. This is a great tool for getting the badguys. Please check for updates, make sure Immunize is enabled, and run it now. I have provided the full install instructions for Spybot below. You do not need to redownload it if you have the newest version; please confirm that you have everything configured correctly. I cannot tell from your log whether you have AdAware. Please download, install, update, configure and run it now. Here are two essential anti-spyware programs which you should run regularly. Updates for these programs come out weekly. Run them now. Spybot Search & Destroy instructions (~3.5MB) Download Spybot (written by Patrick Kolla). Click <download> from http://www.safer-networking.org/ Save spybotsd13.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/spybot/ Doubleclick spybotsd13.exe. Make sure to direct the program to install in the c:/program files/spybot/ directory, NOT the default directory. Open Spybot from Start \| Programs \| Spybot \| Spybot S&D Select <Search for Updates>. Let it install all updates. This is very important! Select <Immunize> Select <Check for Problems> Check all entries that are in RED. Only RED, NOTHING ELSE. For your records, write/print out each item that you have fixed. Date it. Select <Fix Selected Problems> Close Spybot// Ad-Aware instructions (2563 kB) Download Ad-Aware SE build 1.05 (written by Lavasoft) from http://www.lavasoft.de/ If you have a previous version of AdAware installed, you will be prompted to uninstall or keep the older version during installation. Be sure to choose Uninstall The Previous Version. Save aawsepersonal.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/Adaware/ Doubleclick aawsepersonal.exe. Make sure to direct the program to install in the c:/program files/adaware/ directory, NOT the default directory. Open AdAware from Start \| Programs \| Lavasoft \| AdAware. Select <Check for updates now>, <Proceed> Setting adjustments. [[Green = checked]] Click the Gear Icon in the top right corner. New settings: By default you begin in the <General> section. The following should be checked: Automatically save logfile Automatically quarantine objects prior to removal Safe Mode (always request confirmation) Prompt to update outdated confirmation - change to "7 days" Click <Scanning> Check Scan within Archives Select "Select drives & folders to scan", check all of your harddrives. Usually its just c:/, <Proceed> Under Memory & Registry, select all options Click <Advanced> Under Shell Integration, select "Move deleted files to Recycle Bin" Under Logfile detail, select all options Click <Defaults> Type in the full URL of what you want as your default homepage and search page eg. http://www.google.com Click <Tweak> Expand Scanning Engine and make sure the following are selected: Unload recognized processes during scanning Obtain command line of scanned processes Scan registry for all users instead of current user only Expand Cleaning Engine and make sure the following are selected: Always try to unload modules before deletion During removal, unload explorer and IE if necessary Let Windows remove files in use at next reboot Delete quarantined objects after restoring Expand Safety Settings and make sure the following are selected: Write-protect system files after repair (Hosts file, etc) Click <Proceed> \| <Start> \| select Use custom scanning options \| <Next> When the scan is finished, rightclick on any entry and choose <Select All Objects>. Select <Clean> Close AdAware// ---------------------------------------------------------------- Reboot and post a fresh HiJackThis log. Last edited by Detah : 12-28-2004 at 09:43 AM.

12-28-2004, 08:00 PM	#8 (permalink)
originale Registered User Join Date: Sep 2004 Posts: 441 OS: winXP	Detah: This process is making me nervous Hi Detah: I've begun doing what you recommended and I'm sure you wouldn't tell me to do something that will make things worse but..... when I was going to uncheck Hide Protected operating system files it warned me it cd make the system inoperable. What are the risks with the steps you have recommended I take. What happens if safe operating mode doesn't work? BTW- have Ad aware SE and Spybot. Thanks

12-29-2004, 07:04 AM	#10 (permalink)
Detah TSF Enthusiast Join Date: Jun 2004 Location: from IL; now in KY Posts: 642 OS: Win98SE/XP My System	Yes. The default setting for WinXP (and most Windows Operating systems) is to have the core operating system files hidden. However, we (and you) need to see them because sometimes the badguys overwrite important files and put them in the wrong place. So it is important that you are able to 'see' all files on your system. There is no danger of any kind in making them visible. No files are removed with this action and none are added. WinXP can be tricky to boot into Safe Mode, especially with a fast processor. You need to start tapping the F8 key as soon as you reboot. Tap it gently and frequently. Eventually you will end up with a menu of choices. Choose Safe Mode.