i cant get rid of StrongestOptimizer

Quanta123 · 05-07-2007, 01:34 PM

Hi all!

When i Google Hijack This (without the space) the browser (IE or Firefox) immediately closes. When i try to open the thread of Hijack This (again without the space) on techsupportforum the browser immediately closes. (so i couldnt post this in the right place)

Also, and it should be related, i have a program called StrongestOptimizer that i cant uninstall. I tried it through windows add/remove, and it just opens the IE with a button that says uninstall, but does nothing. I also tried the YourUninstaller and same IE page opens. There is a thread in techsupporforum on the subject but i cant read it, the browser closes down.

I deduce that if someone writes Hijack This (without the space) i wont be able to respond to the thread. Ive run the antistuff as it says in the http://forum.grisoft.cz/freeforum/re...7725,backpage= but the problem persists. What do you people think?

Thanks

**Glaswegian** · 05-07-2007, 01:57 PM

Hi there

This is likely a rootkit infection. Please follow these instructions carefully.

Please download combofix.exe to your desktop.
Alternate link.

IMPORTANT - You must place combofix on your desktop!!

Double click combofix.exe & follow the prompts.

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.

Assuming you can post a log, I'll move this thread to our H-J-T Forum.

Quanta123 · 05-07-2007, 02:15 PM

Thx for reply. I really cant see the H-J-T forum. The browser immediately shuts down. Heres the Log:

"Jorge Martins" - 2007-05-07 21:01:54 Service Pack 2
ComboFix 07-05.07.3.V - Running from: "C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\"

((((((((((((((((((((((((((((((( Files Created from 2007-04-07 to 2007-05-07 ))))))))))))))))))))))))))))))))))

2007-05-06 20:20 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-05-06 20:20 <DIR> d-------- C:\Programas\Your Uninstaller 2006
2007-05-06 20:20 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\URSoft

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-06 20:46:22 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\about amok
2007-05-06 19:20:07 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\URSoft
2007-05-06 19:13:35 -------- d--h--w C:\Programas\InstallShield Installation Information
2007-05-06 19:11:55 -------- d-----w C:\Programas\GameSpy Arcade
2007-05-06 19:11:08 -------- d-----w C:\Programas\Finale 2003
2007-05-06 18:46:04 -------- d-----w C:\Programas\eMule
2007-04-25 18:48:41 -------- d-----w C:\Programas\TVU Player
2007-04-25 18:11:45 -------- d-----w C:\Programas\PartyGaming.Net
2007-03-25 17:22:30 64,140 ----a-w C:\WINDOWS\system32\perfc016.dat
2007-03-25 17:22:30 428,328 ----a-w C:\WINDOWS\system32\perfh016.dat
2007-03-17 13:43:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:37:34 578,560 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:37:34 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:37:34 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:33:32 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"="C:\Programas\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx"
"{53707962-6F74-2D53-2644-206D7942484F}"="C:\DOCUME~1\JORGEM~1\AMBIEN~1\ANTI-C~1\SPYBOT~1\SDHelper.dll"
"{8ABC10F3-9DFD-6742-EB72-D9D7C8DD4570}"="C:\WINDOWS\gacud1.dll" [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ESB"="C:\\WINDOWS\\System32\\ESB.exe"
"4mtcsb"="C:\\WINDOWS\\System32\\4mtcsb.EXE"
"PRONoMgr.exe"="C:\\Programas\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"AudioHQ"="C:\\Programas\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE"
"Creative Launcher"="C:\\Programas\\Creative\\Launcher\\CTLauncher.exe"
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"InCD"="C:\\Programas\\Ahead\\InCD\\InCD.exe"
"SunJavaUpdateSched"="C:\\Programas\\Java\\jre1.5.0\\bin\\jusched.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\""
"QuickTime Task"="\"C:\\Programas\\QuickTime\\qttask.exe\" -atboottime"
"GRIDINSIDEDEAF64"="C:\\Documents and Settings\\All Users\\Application Data\\third mags grid inside\\JOYLINK.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart"
"MSMSGS"="\"C:\\Programas\\Messenger\\msmsgs.exe\" /background"
"plus this"="C:\\DOCUME~1\\JORGEM~1\\APPLIC~1\\ABOUTA~1\\SaveIso.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Programas\ewido\security suite\shellhook.dll"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\Anti-coisas\AVG Anti-Spyware 7.5\shellexecutehook.dll"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
HTTPFilter HTTPFilter\0\0
DcomLaunch DcomLaunch\0TermService\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\A9CA42FA91C1FC66.job
C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-07 21:04:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 2007-05-07 21:04:22
C:\ComboFix-quarantined-files.txt ... 2007-05-07 21:04

**Glaswegian** · 05-07-2007, 03:18 PM

Hi again

OK, we’ll continue as best we can. Continue to post back here for now.

You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.

Click on the zip file attached to this post to open and extract the file quanta.reg to your desktop. Double click on the file quanta.reg to run it. Answer yes to any prompts and allow it to merge into the Registry.

Download this tool

http://securityresponse.symantec.com...FixLinkopt.exe

Please run FixLinkopt.exe and follow the prompts.

Once it has finished, it will create a log named FixLinkopt.txt on your desktop. Please post that log in your next reply.

Please reboot your computer.

Download the Gromozon rootkit removal tool from either of the following locations & save it to your Desktop:

Gromozon Remover 1

Gromozon Remover 2

Double-click to run it & follow the prompts.

If an infection is found, it will reboot your machine & produce a log at C:\armada_log.

Please run combofix again, just as you did previously.

Post back with

FixLinkopt.txt
c:\armada_log
c:\combofix.txt

Let me know how things are now.

Quanta123 · 05-07-2007, 06:52 PM

Hi. Thx for reply. Everything is the same. I still cant uninstall StrongestOptimizer and i cant google HJT. Heres the Logs

FixLinkopt.txt-----------------------------------------------------------

Symantec Trojan.Linkoptimizer Removal Tool 1.0.8

Trojan.Linkoptimizer has not been found on your computer.

------------------------------------------------------------------------

gromozon_removal (no armada-log created) ----------------------------

Removal tool loaded into memory
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Programas\Ficheiros comuns

Trojan.Gromozon does not exist - your system is clean.

-------------------------------------------------------------------------

combofix.txt-------------------------------------------------------------

"Jorge Martins" - 2007-05-08 1:39:14 Service Pack 2
ComboFix 07-05.07.3.V - Running from: "C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\"

((((((((((((((((((((((((((((((( Files Created from 2007-04-08 to 2007-05-08 ))))))))))))))))))))))))))))))))))

2007-05-07 21:04 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-05-06 20:20 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-05-06 20:20 <DIR> d-------- C:\Programas\Your Uninstaller 2006
2007-05-06 20:20 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\URSoft

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-06 20:46:22 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\about amok
2007-05-06 19:20:07 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\URSoft
2007-05-06 19:13:35 -------- d--h--w C:\Programas\InstallShield Installation Information
2007-05-06 19:11:55 -------- d-----w C:\Programas\GameSpy Arcade
2007-05-06 19:11:08 -------- d-----w C:\Programas\Finale 2003
2007-05-06 18:46:04 -------- d-----w C:\Programas\eMule
2007-04-25 18:48:41 -------- d-----w C:\Programas\TVU Player
2007-04-25 18:11:45 -------- d-----w C:\Programas\PartyGaming.Net
2007-03-25 17:22:30 64,140 ----a-w C:\WINDOWS\system32\perfc016.dat
2007-03-25 17:22:30 428,328 ----a-w C:\WINDOWS\system32\perfh016.dat
2007-03-17 13:43:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:37:34 578,560 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:37:34 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:37:34 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:33:32 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"="C:\Programas\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx"
"{53707962-6F74-2D53-2644-206D7942484F}"="C:\DOCUME~1\JORGEM~1\AMBIEN~1\ANTI-C~1\SPYBOT~1\SDHelper.dll"
"{8ABC10F3-9DFD-6742-EB72-D9D7C8DD4570}"="C:\WINDOWS\gacud1.dll" [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ESB"="C:\\WINDOWS\\System32\\ESB.exe"
"4mtcsb"="C:\\WINDOWS\\System32\\4mtcsb.EXE"
"PRONoMgr.exe"="C:\\Programas\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"AudioHQ"="C:\\Programas\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE"
"Creative Launcher"="C:\\Programas\\Creative\\Launcher\\CTLauncher.exe"
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"InCD"="C:\\Programas\\Ahead\\InCD\\InCD.exe"
"SunJavaUpdateSched"="C:\\Programas\\Java\\jre1.5.0\\bin\\jusched.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\""
"QuickTime Task"="\"C:\\Programas\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart"
"MSMSGS"="\"C:\\Programas\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Programas\ewido\security suite\shellhook.dll"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\Anti-coisas\AVG Anti-Spyware 7.5\shellexecutehook.dll"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
HTTPFilter HTTPFilter\0\0
DcomLaunch DcomLaunch\0TermService\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\A9CA42FA91C1FC66.job
C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-08 01:41:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 2007-05-08 1:41:33
C:\ComboFix-quarantined-files.txt ... 2007-05-08 01:41
C:\ComboFix2.txt ... 2007-05-07 21:04

-----------------------------------------------------------------------

**Glaswegian** · 05-08-2007, 03:09 PM

Hi again

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.

I have attached a file to this post to remove a hidden LOP task. Click on the zip file attached to open and extract the file quanta.bat to your desktop. Double click on quanta.bat – a window will open and quickly close – this is normal.

Reboot
Reboot your system in Safe Mode.

Restart the computer. The computer begins processing a set of instructions known as BIOS.
After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
Instead of Windows loading as normal, a menu should appear
Use the arrow key to highlight Safe Mode and press Enter.

Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

MessengerPlus3 This program is known to install LOP malware that was present on your system

File Deletions
Delete the following File indicated in RED if it still exists.

C:\WINDOWS\gacud1.dll

Reboot
Reboot your system in Normal Mode.

Please download this tool > System Repair Engineer

Extract it to it's own folder & double click SREng.exe to run it
Select 'Smart Scan' & tick "Verify Digital Signatures"
Click on the [Scan] button
When finished, click on the [Save Reports] button & save the log to Desktop
Attach the log in your next reply. Dont post it

Note: You may have to rename SREngLog.log to SREngLog.txt before attaching.

Quanta123 · 05-08-2007, 04:24 PM

Hi. Thx again. The file is attached.

**Glaswegian** · 05-10-2007, 12:28 PM

Hi again

Apologies for any delay - my internet connection vanished last night just after I'd logged on and I couldn't restore it.

Please delete any existing version of combofix - we need to use a slightly different version.

Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!
*NOTE* If you have a 64bit Operating System then CleanUp! is not suitable. You can use IE to download this script and then run it to check.

Download combofix from here http://download.bleepingcomputer.com...a/ComboFix.exe

IMPORTANT - You must place combofix on your desktop!!

Reboot
Reboot your system in Safe Mode.

Restart the computer. The computer begins processing a set of instructions known as BIOS.
After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
Instead of Windows loading as normal, a menu should appear
Use the arrow key to highlight Safe Mode and press Enter.

Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:

Empty Recycle Bins
Delete Cookies
Delete Prefetch files
Cleanup! All Users
Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and reboot into Norma Mode when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.

Double click combofix.exe & follow the prompts.

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.

Post back with c:\combofix.txt

Quanta123 · 05-10-2007, 01:55 PM

Hi. Thx for reply, Sorry about your connection. Heres the log:

"Jorge Martins" - 2007-05-10 20:45:31 Service Pack 2
ComboFix 07-05.11.V - Running from: "C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\"

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-10 ))))))))))))))))))))))))))))))))))

2007-05-09 19:59 <DIR> d-------- C:\Programas\SopCast
2007-05-09 19:59 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\SopCast
2007-05-07 21:04 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-05-06 20:20 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-05-06 20:20 <DIR> d-------- C:\Programas\Your Uninstaller 2006
2007-05-06 20:20 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\URSoft

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-06 20:46:22 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1\about amok
2007-05-06 19:13:35 -------- d--h--w C:\Programas\InstallShield Installation Information
2007-05-06 19:11:55 -------- d-----w C:\Programas\GameSpy Arcade
2007-05-06 19:11:08 -------- d-----w C:\Programas\Finale 2003
2007-05-06 18:46:04 -------- d-----w C:\Programas\eMule
2007-04-25 18:48:41 -------- d-----w C:\Programas\TVU Player
2007-04-25 18:11:45 -------- d-----w C:\Programas\PartyGaming.Net
2007-03-25 17:22:30 64,140 ----a-w C:\WINDOWS\system32\perfc016.dat
2007-03-25 17:22:30 428,328 ----a-w C:\WINDOWS\system32\perfh016.dat
2007-03-17 13:43:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:37:34 578,560 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:37:34 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:37:34 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:33:32 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
2007-02-05 20:18:52 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Programas\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
{53707962-6F74-2D53-2644-206D7942484F}=C:\DOCUME~1\JORGEM~1\AMBIEN~1\ANTI-C~1\SPYBOT~1\SDHelper.dll
{8ABC10F3-9DFD-6742-EB72-D9D7C8DD4570}=C:\WINDOWS\gacud1.dll [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ESB"="C:\\WINDOWS\\System32\\ESB.exe"
"4mtcsb"="C:\\WINDOWS\\System32\\4mtcsb.EXE"
"PRONoMgr.exe"="C:\\Programas\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"AudioHQ"="C:\\Programas\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE"
"Creative Launcher"="C:\\Programas\\Creative\\Launcher\\CTLauncher.exe"
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"InCD"="C:\\Programas\\Ahead\\InCD\\InCD.exe"
"SunJavaUpdateSched"="C:\\Programas\\Java\\jre1.5.0\\bin\\jusched.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"QuickTime Task"="\"C:\\Programas\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ESB"="C:\WINDOWS\System32\ESB.exe" [2002-12-02 02:32]
"4mtcsb"="C:\WINDOWS\System32\4mtcsb.EXE" [2002-11-29 12:45]
"PRONoMgr.exe"="C:\Programas\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:21]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-03-11 03:24]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-03-11 03:11]
"AudioHQ"="C:\Programas\Creative\SBLive\AudioHQ\AHQTB.EXE" [1999-04-12 02:00]
"Creative Launcher"="C:\Programas\Creative\Launcher\CTLauncher.exe" []
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 11:50]
"InCD"="C:\Programas\Ahead\InCD\InCD.exe" [2003-06-03 10:54]
"SunJavaUpdateSched"="C:\Programas\Java\jre1.5.0\bin\jusched.exe" [2004-09-03 06:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-23 15:04]
"QuickTime Task"="C:\Programas\QuickTime\qttask.exe" [2005-09-05 04:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"MSMSGS"="C:\Programas\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Programas\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Programas\ewido\security suite\shellhook.dll"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\Anti-coisas\AVG Anti-Spyware 7.5\shellexecutehook.dll"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
HTTPFilter HTTPFilter\0\0
DcomLaunch DcomLaunch\0TermService\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-10 20:49:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 2007-05-10 20:49:47
C:\ComboFix-quarantined-files.txt ... 2007-05-10 20:49
C:\ComboFix2.txt ... 2007-05-08 01:41
C:\ComboFix3.txt ... 2007-05-07 21:04

**Glaswegian** · 05-10-2007, 02:14 PM

Hi again

Turned out the whole street was down, so I’m glad it wasn’t anything I did…

There is one file that just refuses to go away. Let’s see if it’s the one that’s causing the problems…

1. Please download The Avenger to your Desktop.

Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Code:

Files to delete:
C:\WINDOWS\gacud1.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer.
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt at the end of this fix.

Quanta123 · 05-10-2007, 02:42 PM

Hi. If i try to download Avenger the browser shuts down, just like when i google HJT. Could you attach in next message the file with another name perhaps, not shure if it works though.

05-07-2007, 01:34 PM	#1 (permalink)
Quanta123 Registered User Join Date: May 2007 Posts: 31 OS: XP	i cant get rid of StrongestOptimizer Hi all! When i Google Hijack This (without the space) the browser (IE or Firefox) immediately closes. When i try to open the thread of Hijack This (again without the space) on techsupportforum the browser immediately closes. (so i couldnt post this in the right place) Also, and it should be related, i have a program called StrongestOptimizer that i cant uninstall. I tried it through windows add/remove, and it just opens the IE with a button that says uninstall, but does nothing. I also tried the YourUninstaller and same IE page opens. There is a thread in techsupporforum on the subject but i cant read it, the browser closes down. I deduce that if someone writes Hijack This (without the space) i wont be able to respond to the thread. Ive run the antistuff as it says in the http://forum.grisoft.cz/freeforum/re...7725,backpage= but the problem persists. What do you people think? Thanks Last edited by tetonbob : 05-07-2007 at 07:44 PM. Reason: changed html code to bbcode for link

05-07-2007, 01:57 PM	#2 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,771 OS: Win XP Pro SP3 My System Blog Entries: 10	Re: i cant get rid of StrongestOptimizer Hi there This is likely a rootkit infection. Please follow these instructions carefully. Please download combofix.exe to your desktop. Alternate link. IMPORTANT - You must place combofix on your desktop!! Double click combofix.exe & follow the prompts. When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall. Assuming you can post a log, I'll move this thread to our H-J-T Forum. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs

05-07-2007, 02:15 PM	#3 (permalink)
Quanta123 Registered User Join Date: May 2007 Posts: 31 OS: XP	Re: i cant get rid of StrongestOptimizer Thx for reply. I really cant see the H-J-T forum. The browser immediately shuts down. Heres the Log: "Jorge Martins" - 2007-05-07 21:01:54 Service Pack 2 ComboFix 07-05.07.3.V - Running from: "C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-07 to 2007-05-07 )))))))))))))))))))))))))))))))))) 2007-05-06 20:20 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-05-06 20:20 <DIR> d-------- C:\Programas\Your Uninstaller 2006 2007-05-06 20:20 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\URSoft (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-06 20:46:22 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\about amok 2007-05-06 19:20:07 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\URSoft 2007-05-06 19:13:35 -------- d--h--w C:\Programas\InstallShield Installation Information 2007-05-06 19:11:55 -------- d-----w C:\Programas\GameSpy Arcade 2007-05-06 19:11:08 -------- d-----w C:\Programas\Finale 2003 2007-05-06 18:46:04 -------- d-----w C:\Programas\eMule 2007-04-25 18:48:41 -------- d-----w C:\Programas\TVU Player 2007-04-25 18:11:45 -------- d-----w C:\Programas\PartyGaming.Net 2007-03-25 17:22:30 64,140 ----a-w C:\WINDOWS\system32\perfc016.dat 2007-03-25 17:22:30 428,328 ----a-w C:\WINDOWS\system32\perfh016.dat 2007-03-17 13:43:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:37:34 578,560 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:37:34 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:37:34 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:33:32 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"="C:\Programas\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx" "{53707962-6F74-2D53-2644-206D7942484F}"="C:\DOCUME~1\JORGEM~1\AMBIEN~1\ANTI-C~1\SPYBOT~1\SDHelper.dll" "{8ABC10F3-9DFD-6742-EB72-D9D7C8DD4570}"="C:\WINDOWS\gacud1.dll" [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ESB"="C:\\WINDOWS\\System32\\ESB.exe" "4mtcsb"="C:\\WINDOWS\\System32\\4mtcsb.EXE" "PRONoMgr.exe"="C:\\Programas\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "AudioHQ"="C:\\Programas\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "Creative Launcher"="C:\\Programas\\Creative\\Launcher\\CTLauncher.exe" "NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe" "InCD"="C:\\Programas\\Ahead\\InCD\\InCD.exe" "SunJavaUpdateSched"="C:\\Programas\\Java\\jre1.5.0\\bin\\jusched.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\"" "QuickTime Task"="\"C:\\Programas\\QuickTime\\qttask.exe\" -atboottime" "GRIDINSIDEDEAF64"="C:\\Documents and Settings\\All Users\\Application Data\\third mags grid inside\\JOYLINK.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart" "MSMSGS"="\"C:\\Programas\\Messenger\\msmsgs.exe\" /background" "plus this"="C:\\DOCUME~1\\JORGEM~1\\APPLIC~1\\ABOUTA~1\\SaveIso.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Programas\ewido\security suite\shellhook.dll" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\Anti-coisas\AVG Anti-Spyware 7.5\shellexecutehook.dll" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\A9CA42FA91C1FC66.job C:\WINDOWS\tasks\Symantec NetDetect.job ****************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-07 21:04:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ****************************************************************** Completion time: 2007-05-07 21:04:22 C:\ComboFix-quarantined-files.txt ... 2007-05-07 21:04

05-07-2007, 03:18 PM	#4 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,771 OS: Win XP Pro SP3 My System Blog Entries: 10	Re: i cant get rid of StrongestOptimizer Hi again OK, we’ll continue as best we can. Continue to post back here for now. You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply. Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below. Click on the zip file attached to this post to open and extract the file quanta.reg to your desktop. Double click on the file quanta.reg to run it. Answer yes to any prompts and allow it to merge into the Registry. Download this tool http://securityresponse.symantec.com...FixLinkopt.exe Please run FixLinkopt.exe and follow the prompts. Once it has finished, it will create a log named FixLinkopt.txt on your desktop. Please post that log in your next reply. Please reboot your computer. Download the Gromozon rootkit removal tool from either of the following locations & save it to your Desktop: Gromozon Remover 1 Gromozon Remover 2 Double-click to run it & follow the prompts. If an infection is found, it will reboot your machine & produce a log at C:\armada_log. Please run combofix again, just as you did previously. Post back with FixLinkopt.txt c:\armada_log c:\combofix.txt Let me know how things are now. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs Last edited by Glaswegian : 03-27-2008 at 04:11 PM.

05-07-2007, 06:52 PM	#5 (permalink)
Quanta123 Registered User Join Date: May 2007 Posts: 31 OS: XP	Re: i cant get rid of StrongestOptimizer Hi. Thx for reply. Everything is the same. I still cant uninstall StrongestOptimizer and i cant google HJT. Heres the Logs FixLinkopt.txt----------------------------------------------------------- Symantec Trojan.Linkoptimizer Removal Tool 1.0.8 Trojan.Linkoptimizer has not been found on your computer. ------------------------------------------------------------------------ gromozon_removal (no armada-log created) ---------------------------- Removal tool loaded into memory Gromozon rootkit component not detected - searching for other components Scanning: C:\WINDOWS Scanning: C:\Programas\Ficheiros comuns Trojan.Gromozon does not exist - your system is clean. ------------------------------------------------------------------------- combofix.txt------------------------------------------------------------- "Jorge Martins" - 2007-05-08 1:39:14 Service Pack 2 ComboFix 07-05.07.3.V - Running from: "C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-08 to 2007-05-08 )))))))))))))))))))))))))))))))))) 2007-05-07 21:04 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-06 20:20 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-05-06 20:20 <DIR> d-------- C:\Programas\Your Uninstaller 2006 2007-05-06 20:20 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\URSoft (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-06 20:46:22 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\about amok 2007-05-06 19:20:07 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1.\URSoft 2007-05-06 19:13:35 -------- d--h--w C:\Programas\InstallShield Installation Information 2007-05-06 19:11:55 -------- d-----w C:\Programas\GameSpy Arcade 2007-05-06 19:11:08 -------- d-----w C:\Programas\Finale 2003 2007-05-06 18:46:04 -------- d-----w C:\Programas\eMule 2007-04-25 18:48:41 -------- d-----w C:\Programas\TVU Player 2007-04-25 18:11:45 -------- d-----w C:\Programas\PartyGaming.Net 2007-03-25 17:22:30 64,140 ----a-w C:\WINDOWS\system32\perfc016.dat 2007-03-25 17:22:30 428,328 ----a-w C:\WINDOWS\system32\perfh016.dat 2007-03-17 13:43:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:37:34 578,560 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:37:34 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:37:34 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:33:32 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"="C:\Programas\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx" "{53707962-6F74-2D53-2644-206D7942484F}"="C:\DOCUME~1\JORGEM~1\AMBIEN~1\ANTI-C~1\SPYBOT~1\SDHelper.dll" "{8ABC10F3-9DFD-6742-EB72-D9D7C8DD4570}"="C:\WINDOWS\gacud1.dll" [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ESB"="C:\\WINDOWS\\System32\\ESB.exe" "4mtcsb"="C:\\WINDOWS\\System32\\4mtcsb.EXE" "PRONoMgr.exe"="C:\\Programas\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "AudioHQ"="C:\\Programas\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "Creative Launcher"="C:\\Programas\\Creative\\Launcher\\CTLauncher.exe" "NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe" "InCD"="C:\\Programas\\Ahead\\InCD\\InCD.exe" "SunJavaUpdateSched"="C:\\Programas\\Java\\jre1.5.0\\bin\\jusched.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\"" "QuickTime Task"="\"C:\\Programas\\QuickTime\\qttask.exe\" -atboottime" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "MessengerPlus3"="\"C:\\Programas\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart" "MSMSGS"="\"C:\\Programas\\Messenger\\msmsgs.exe\" /background" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Programas\ewido\security suite\shellhook.dll" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\Anti-coisas\AVG Anti-Spyware 7.5\shellexecutehook.dll" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\A9CA42FA91C1FC66.job C:\WINDOWS\tasks\Symantec NetDetect.job ****************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-08 01:41:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ****************************************************************** Completion time: 2007-05-08 1:41:33 C:\ComboFix-quarantined-files.txt ... 2007-05-08 01:41 C:\ComboFix2.txt ... 2007-05-07 21:04 -----------------------------------------------------------------------

05-08-2007, 03:09 PM	#6 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,771 OS: Win XP Pro SP3 My System Blog Entries: 10	Re: i cant get rid of StrongestOptimizer Hi again Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below. I have attached a file to this post to remove a hidden LOP task. Click on the zip file attached to open and extract the file quanta.bat to your desktop. Double click on quanta.bat – a window will open and quickly close – this is normal. Reboot Reboot your system in Safe Mode. Restart the computer. The computer begins processing a set of instructions known as BIOS. After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key) Instead of Windows loading as normal, a menu should appear Use the arrow key to highlight Safe Mode and press Enter. Uninstall Programmes Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present): MessengerPlus3 This program is known to install LOP malware that was present on your system File Deletions Delete the following File indicated in RED if it still exists. C:\WINDOWS\gacud1.dll Reboot Reboot your system in Normal Mode. Please download this tool > System Repair Engineer Extract it to it's own folder & double click SREng.exe to run it Select 'Smart Scan' & tick "Verify Digital Signatures" Click on the [Scan] button When finished, click on the [Save Reports] button & save the log to Desktop Attach the log in your next reply. Dont post it Note: You may have to rename SREngLog.log to SREngLog.txt before attaching. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs Last edited by Glaswegian : 03-27-2008 at 04:11 PM.

05-10-2007, 12:28 PM	#8 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,771 OS: Win XP Pro SP3 My System Blog Entries: 10	Re: i cant get rid of StrongestOptimizer Hi again Apologies for any delay - my internet connection vanished last night just after I'd logged on and I couldn't restore it. Please delete any existing version of combofix - we need to use a slightly different version. Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later. NOTE Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! NOTE If you have a 64bit Operating System then CleanUp! is not suitable. You can use IE to download this script and then run it to check. Download combofix from here http://download.bleepingcomputer.com...a/ComboFix.exe IMPORTANT - You must place combofix on your desktop!! Reboot Reboot your system in Safe Mode. Restart the computer. The computer begins processing a set of instructions known as BIOS. After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key) Instead of Windows loading as normal, a menu should appear Use the arrow key to highlight Safe Mode and press Enter. Run CleanUp! NOTE Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows: Click Options Move the slider button down to Custom CleanUp! Check the following: Empty Recycle Bins Delete Cookies Delete Prefetch files Cleanup! All Users Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked. Click OK, Press the CleanUp! button to start the program and reboot into Norma Mode when prompted. Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility. Double click combofix.exe & follow the prompts. When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall. Post back with c:\combofix.txt __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs

05-10-2007, 01:55 PM	#9 (permalink)
Quanta123 Registered User Join Date: May 2007 Posts: 31 OS: XP	Re: i cant get rid of StrongestOptimizer Hi. Thx for reply, Sorry about your connection. Heres the log: "Jorge Martins" - 2007-05-10 20:45:31 Service Pack 2 ComboFix 07-05.11.V - Running from: "C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-10 )))))))))))))))))))))))))))))))))) 2007-05-09 19:59 <DIR> d-------- C:\Programas\SopCast 2007-05-09 19:59 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\SopCast 2007-05-07 21:04 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-06 20:20 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-05-06 20:20 <DIR> d-------- C:\Programas\Your Uninstaller 2006 2007-05-06 20:20 <DIR> d-------- C:\DOCUME~1\JORGEM~1\APPLIC~1\URSoft (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-06 20:46:22 -------- d-----w C:\DOCUME~1\JORGEM~1\APPLIC~1\about amok 2007-05-06 19:13:35 -------- d--h--w C:\Programas\InstallShield Installation Information 2007-05-06 19:11:55 -------- d-----w C:\Programas\GameSpy Arcade 2007-05-06 19:11:08 -------- d-----w C:\Programas\Finale 2003 2007-05-06 18:46:04 -------- d-----w C:\Programas\eMule 2007-04-25 18:48:41 -------- d-----w C:\Programas\TVU Player 2007-04-25 18:11:45 -------- d-----w C:\Programas\PartyGaming.Net 2007-03-25 17:22:30 64,140 ----a-w C:\WINDOWS\system32\perfc016.dat 2007-03-25 17:22:30 428,328 ----a-w C:\WINDOWS\system32\perfh016.dat 2007-03-17 13:43:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:37:34 578,560 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:37:34 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:37:34 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:33:32 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:18:52 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Programas\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx {53707962-6F74-2D53-2644-206D7942484F}=C:\DOCUME~1\JORGEM~1\AMBIEN~1\ANTI-C~1\SPYBOT~1\SDHelper.dll {8ABC10F3-9DFD-6742-EB72-D9D7C8DD4570}=C:\WINDOWS\gacud1.dll [x] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ESB"="C:\\WINDOWS\\System32\\ESB.exe" "4mtcsb"="C:\\WINDOWS\\System32\\4mtcsb.EXE" "PRONoMgr.exe"="C:\\Programas\\Intel\\NCS\\PROSet\\PRONoMgr.exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "AudioHQ"="C:\\Programas\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "Creative Launcher"="C:\\Programas\\Creative\\Launcher\\CTLauncher.exe" "NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe" "InCD"="C:\\Programas\\Ahead\\InCD\\InCD.exe" "SunJavaUpdateSched"="C:\\Programas\\Java\\jre1.5.0\\bin\\jusched.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "QuickTime Task"="\"C:\\Programas\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ESB"="C:\WINDOWS\System32\ESB.exe" [2002-12-02 02:32] "4mtcsb"="C:\WINDOWS\System32\4mtcsb.EXE" [2002-11-29 12:45] "PRONoMgr.exe"="C:\Programas\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:21] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-03-11 03:24] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-03-11 03:11] "AudioHQ"="C:\Programas\Creative\SBLive\AudioHQ\AHQTB.EXE" [1999-04-12 02:00] "Creative Launcher"="C:\Programas\Creative\Launcher\CTLauncher.exe" [] "NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 11:50] "InCD"="C:\Programas\Ahead\InCD\InCD.exe" [2003-06-03 10:54] "SunJavaUpdateSched"="C:\Programas\Java\jre1.5.0\bin\jusched.exe" [2004-09-03 06:50] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-23 15:04] "QuickTime Task"="C:\Programas\QuickTime\qttask.exe" [2005-09-05 04:30] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56] "MSMSGS"="C:\Programas\Messenger\msmsgs.exe" [2004-10-13 17:24] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "MSMSGS"="\"C:\\Programas\\Messenger\\msmsgs.exe\" /background" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="C:\Programas\ewido\security suite\shellhook.dll" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Documents and Settings\Jorge Martins\Ambiente de trabalho\Anti-coisas\AVG Anti-Spyware 7.5\shellexecutehook.dll" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job ****************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-10 20:49:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ****************************************************************** Completion time: 2007-05-10 20:49:47 C:\ComboFix-quarantined-files.txt ... 2007-05-10 20:49 C:\ComboFix2.txt ... 2007-05-08 01:41 C:\ComboFix3.txt ... 2007-05-07 21:04

05-10-2007, 02:14 PM	#10 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,771 OS: Win XP Pro SP3 My System Blog Entries: 10	Re: i cant get rid of StrongestOptimizer Hi again Turned out the whole street was down, so I’m glad it wasn’t anything I did… There is one file that just refuses to go away. Let’s see if it’s the one that’s causing the problems… 1. Please download The Avenger to your Desktop. Click on Avenger.zip to open the file Extract avenger.exe to your desktop 2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C): Code: Files to delete: C:\WINDOWS\gacud1.dll Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. 3. Now, start The Avenger program by clicking on its icon on your desktop. Under "Script file to execute" choose "Input Script Manually". Now click on the Magnifying Glass icon which will open a new window titled "View/edit script" Paste the text copied to clipboard into this window by pressing (Ctrl+V). Click Done Now click on the Green Light to begin execution of the script Answer "Yes" twice when prompted. 4. The Avenger will automatically do the following: It will Restart your computer. On reboot, it will briefly open a black command window on your desktop, this is normal. After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip. 5. Please copy/paste the content of c:\avenger.txt at the end of this fix. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs

05-10-2007, 02:42 PM	#11 (permalink)
Quanta123 Registered User Join Date: May 2007 Posts: 31 OS: XP	Re: i cant get rid of StrongestOptimizer Hi. If i try to download Avenger the browser shuts down, just like when i google HJT. Could you attach in next message the file with another name perhaps, not shure if it works though.