"Fakevirus" gone, or is it?

[Dogge]

I were infected by something that kept popping up in my tray and saying that I had a virus.

This is a screenshot that someone with the same problem has taken:
http://pg.photos.yahoo.com/ph/alevar...cd.jpg&.src=ph

I had just rebooted my computer and quite suddenly got this virus/malware w/e. I had something similiar before, but it kept installing a fake anti-malware program called SpyAxe. Anyway, I used loads of programs like Ewido, SmitFraudFix, AdAware and some more and now the virus is gone, atleast I think so.

If I remember right I had some weird process named something like "attk" which were terminated by AdAware, or atleast that's what it said.
Anyway, here is my HiJackThis-log.


Logfile of HijackThis v1.99.1
Scan saved at 02:32:02, on 2006-06-07
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
C:\Program\Delade filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\VM_STI.EXE
C:\Program\Delade filer\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\SMANTE~1\POOL32~1.EXE
C:\WINDOWS\DOBE~1\fast.exe
C:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
F:\Program\Norton Antivirus 2005\navapsvc.exe
F:\Program\Norton Antivirus 2005\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Douglas\Skrivbord\ewido anti-malware\ewidoctrl.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis\HijackThis.exe
C:\Program\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: (no name) - {F8EB4BDF-DB42-F2B4-6DA7-F25D37C34E9D} - C:\WINDOWS\System32\twux.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program\Norton Antivirus 2005\NavShExt.dll
O2 - BHO: (no name) - {F8EB4BDF-DB42-F2B4-6DA7-F25D37C34E9D} - C:\WINDOWS\System32\twux.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program\Norton Antivirus 2005\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [61231003.exe] C:\WINDOWS\System32\61231003.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program\Delade filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Kymhlhlt] C:\WINDOWS\system32\SMANTE~1\POOL32~1.EXE
O4 - HKCU\..\Run: [Stos] "C:\WINDOWS\DOBE~1\fast.exe" -vt yax
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program\MS office XP Pro Swe\Office10\OSA.EXE
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://F:\Program\MSOFFI~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/Yazzl...cab?refid=1123
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\System32\scanregw.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Douglas\Skrivbord\ewido anti-malware\ewidoctrl.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - F:\Program\Norton Antivirus 2005\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - F:\Program\Norton Antivirus 2005\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program\Norton Antivirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program\DELADE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\CCPD-LC\symlcsvc.exe


I'll check back frequently and will be quick with any instructions you give me.
Thank you in advance.

[MoralTerror]

Hi and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please be patient with me during this time.

[MoralTerror]

Hi Dogge

Please print out or copy this page to Notepad in order to assist you while carrying out the following instructions. This page will not be available to you at some points during the fix. Please read the instructions carefully before you begin and if you have any questions then post them here before continuing. It is important you carry out the instructions in the exact order stated. Please make sure that all other windows (including browsers) are closed while carrying out the fixes.

To ensure you have the latest version of SmitfraudFix Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

IMPORTANT: Do NOT run option #2 OR any other option until you are directed to do so!

I see you already have Ewido. You will need to update Ewido to the latest definition files.
Launch Ewido & click Update from the left pane
Then click on Start Update.

If you are having problems with the updater, you can use this link to manually update Ewido
When you have finished updating, EXIT Ewido.

Please download Cleanup! and install it. You will use this later.

*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.If you have any files or programs stored in a temporary folder then please make backups before running cleanup. Do not run cleanup on XP 64-bit edition. If your not sure if you have 64-bit then you probably don't. You can make sure by downloading and running this tool http://www.mvps.org/marksxp/Download...p_whichcpu.vbs (download using IE)

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files (if present)
• Cleanup! All Users
• Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.

Click OK
Press the CleanUp! button to start the program and reboot when prompted into Safe Mode

Boot to Safe Mode (by repeatedly tapping F8 until the menu appears)

Go to My Computer >Tools >Folder Options >View tab and select Show hidden files and folders. Uncheck the Hide protected operating system files (recommended) option. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK.

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

• Click Scanner
• Click Complete System Scan to begin scanning.
• Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

* "Perform action on all infections"
* Choose clean and click OK.


Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.

Reboot the system. Boot back into Safe Mode (by repeatedly tapping F8 until the menu appears)

Open Start > Control Panel > Add/Remove Programs and uninstall the following programs (If they still exist)

PurityScan by OIN
Snowball Wars by OIN
Yazzle by OIN
or any programs by OIN

Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any)

R3 - URLSearchHook: (no name) - {F8EB4BDF-DB42-F2B4-6DA7-F25D37C34E9D} - C:\WINDOWS\System32\twux.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {F8EB4BDF-DB42-F2B4-6DA7-F25D37C34E9D} - C:\WINDOWS\System32\twux.dll (file missing)
O4 - HKLM\..\Run: [61231003.exe] C:\WINDOWS\System32\61231003.exe
O4 - HKCU\..\Run: [Kymhlhlt] C:\WINDOWS\system32\SMANTE~1\POOL32~1.EXE
O4 - HKCU\..\Run: [Stos] "C:\WINDOWS\DOBE~1\fast.exe" -vt yax
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/Yazzl...cab?refid=1123
O20 - AppInit_DLLs: C:\WINDOWS\System32\scanregw.dll



Please remember to close all other windows, including browsers then click Fix checked.

Delete the following Files indicated in RED and Folders in BLUE if they still exist.

C:\Program\Purity Scan
C:\Program\Yazzle
C:\Program\Snowball Wars
C:\WINDOWS\DOBE~1 <<< make sure NOT to delete the legit ADOBE folder
C:\WINDOWS\System32\ scanregw.dll
C:\WINDOWS\System32\ twux.dll
C:\WINDOWS\System32\ 61231003.exe
C:\WINDOWS\system32\SMANTE~1 <<< make sure NOT to delete the legit SYMANTEC folder



Reboot to Normal mode

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"
and a text file will appear which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

IMPORTANT: Do NOT run option #2 OR any other option until you are directed to do so!

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner

1. Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on See report then click Save report

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan


Post the Panda Scan report and a new HijackThis log

Required Logs

Ewido report
rapport.txt (from the SmitfraudFix tool)
Panda report
new HijackThis log

[Dogge]

I were unable to remove the C:\WINDOWS\System32\scanregw.dll.

But otherwise I followed your guide 100%. Here are the logs:

SmitFraudFix v2.56

Scan done at 21:22:50,29, 2006-06-08
Run from C:\Documents and Settings\Douglas\Skrivbord\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Douglas\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End


Pandascan:

Incident Status Location

Adware:adware/emediacodec Not disinfected c:\documents and settings\all users\skrivbord\Online Security Guide.url
Adware:adware/securityerror Not disinfected C:\Documents and Settings\Douglas\Favoriter\Antivirus Test Online.url
Adware:adware/yazzlesudoku Not disinfected Windows Registry
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Douglas\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\s8sfoyp9.default\Cache\633285D9d01[SmitfraudFix/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Douglas\Skrivbord\SmitfraudFix\SmitfraudFix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Douglas\Skrivbord\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\scanregw.dll


Logfile of HijackThis v1.99.1
Scan saved at 21:57:48, on 2006-06-08
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Delade filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Symantec Shared\ccApp.exe
C:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Documents and Settings\Douglas\Skrivbord\ewido anti-malware\ewidoctrl.exe
F:\Program\Norton Antivirus 2005\navapsvc.exe
F:\Program\Norton Antivirus 2005\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\CCPD-LC\symlcsvc.exe
F:\Program\MS office XP Pro Swe\Office10\WINWORD.EXE
C:\Program\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis\HijackThis.exe
C:\Program\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program\Norton Antivirus 2005\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program\Norton Antivirus 2005\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program\Delade filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program\MS office XP Pro Swe\Office10\OSA.EXE
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://F:\Program\MSOFFI~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Douglas\Skrivbord\ewido anti-malware\ewidoctrl.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - F:\Program\Norton Antivirus 2005\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - F:\Program\Norton Antivirus 2005\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program\Norton Antivirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program\DELADE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\CCPD-LC\symlcsvc.exe



EDIT: I forgot to tell you that my Ewido scan was clean.

[MoralTerror]

Hi Dogge

Click Start > Run and type the following line and click OK.

regsvr32 /u C:\WINDOWS\System32\scanregw.dll

*Note: You may receive a message saying registration failed click OK and continue with the fix.

Delete the following Files indicated in RED (If they still exist)

c:\documents and settings\all users\skrivbord\Online Security Guide.url
C:\Documents and Settings\Douglas\Favoriter\Antivirus Test Online.url
C:\WINDOWS\System32\scanregw.dll


Perform an online scan with Internet Explorer with

Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended Scan
  • Scan Options:
  • Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Take note the names and locations of any file it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan


Required Logs

Kaspersky results
new HijackThis log


How is the computer running now???

[Dogge]

My computer is running quite fine. Maybe get a pop-up now and then nothing crucial.

Here's my kaspersky and hijack logs:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, June 12, 2006 11:50:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 12/06/2006
Kaspersky Anti-Virus database records: 200061
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 29685
Number of viruses found: 14
Number of infected objects: 36
Number of suspicious objects: 0
Duration of the scan process: 00:24:32

Infected Object Name / Virus Name / Last Action
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP10\A0001253.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP10\A0002253.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP10\A0003253.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP14\A0003356.exe Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP14\A0003357.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP14\A0003368.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP14\A0004368.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP14\A0004375.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP14\A0005375.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP16\A0005544.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP16\A0005769.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP16\A0005778.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP16\A0005785.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP16\A0005787.exe Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP55\A0006335.tlb Infected: Trojan-Downloader.Win32.Zlob.rk skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP55\A0006384.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP55\A0006388.exe Infected: Trojan-Downloader.Win32.Zlob.rk skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP55\A0006389.exe Infected: Trojan-Downloader.Win32.Zlob.rk skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP59\A0006672.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP59\A0006826.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP59\A0006829.dll Infected: not-virus:Hoax.Win32.Renos.cw skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP6\A0000139.exe Infected: Trojan-Downloader.Win32.Zlob.rb skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP6\A0000190.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP7\A0000250.exe Infected: not-a-virus:AdWare.Win32.MediaTickets.w skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP7\A0000254.tlb Infected: Trojan-Downloader.Win32.Zlob.qt skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP84\A0007755.dll Infected: not-virus:Hoax.Win32.Renos.dj skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP84\A0007773.exe Infected: Trojan-Downloader.Win32.PurityScan.cp skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP84\A0007774.exe Infected: Trojan-Downloader.Win32.Zlob.rf skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP84\A0007775.exe Infected: Trojan-Downloader.Win32.PurityScan.cn skipped
C:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP87\A0008952.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
F:\Program\Norton Antivirus 2005\Quarantine\261F3AFC.exe Infected: not-a-virus:Porn-Dialer.Win32.PluginAccess.gen skipped
F:\Program\Norton Antivirus 2005\Quarantine\262264F8.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
F:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP6\A0000193.exe/stream/data0002 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
F:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP6\A0000193.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
F:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP6\A0000193.exe NSIS: infected - 2 skipped
F:\System Volume Information\_restore{3A3FB338-1B0E-404C-82AF-31322ECE571C}\RP84\A0007765.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped

Scan process completed.




Logfile of HijackThis v1.99.1
Scan saved at 23:53:27, on 2006-06-12
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
C:\Program\Delade filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program\Delade filer\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Documents and Settings\Douglas\Skrivbord\ewido anti-malware\ewidoctrl.exe
F:\Program\Norton Antivirus 2005\navapsvc.exe
F:\Program\Norton Antivirus 2005\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\rsvp.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Mozilla Firefox\firefox.exe
F:\Program\Winamp\Winamp.exe
C:\HJT\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program\Norton Antivirus 2005\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program\Norton Antivirus 2005\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program\Delade filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program\MS office XP Pro Swe\Office10\OSA.EXE
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://F:\Program\MSOFFI~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Douglas\Skrivbord\ewido anti-malware\ewidoctrl.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - F:\Program\Norton Antivirus 2005\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - F:\Program\Norton Antivirus 2005\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program\Norton Antivirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program\DELADE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\CCPD-LC\symlcsvc.exe

[MoralTerror]

Hi Dogge

Your logs look clean now. If there are no more issues then you should be good to go. We have a few things to deal with 1st.

Kindly follow these simple steps in order to keep your computer clean and secure:

1. Please use Symantec's guide to remove the Norton Quarantine files.
   
   
2. CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
   Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
   • Tick on the checkbox - Turn off System Restore on all drives
   • Click Apply
   Turn it back 'On' by unticking the same checkbox & click OK
   
   
   
3. DISABLE THE VIEWING OF SYSTEM FILES
   From Windows Explorer, go to Tools>Folder Options> View tab.
   • Untick - Show hidden files and folder
   • Tick - Hide file extensions for known types
   • Tick - Hide protected operating system files
   Click Yes to confirm & then click OK
   
   
   
4. SECURING INTERNET EXPLORER
   From within Internet Explorer click on the Tools menu and then click on Internet Options.
   • Select the Security tab
     • Click once on the Internet icon so it becomes highlighted.
     • Select Custom Level .
       • Change 'Download signed ActiveX controls' to Prompt
       • Change 'Download unsigned ActiveX controls' to Disable
       • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
       • Change 'Installation of desktop items' to Prompt
       • Change 'Launching programs and files in an IFRAME' to Prompt
       • Change 'Navigate sub-frames across different domains' to Prompt
       • When all these changes have been made, click on the OK button.
     • If it prompts you as to whether or not you want to save the settings, press the Yes button.
   • Select OK to exit the Internet Properties page.
   
   
   
5. ANTIVIRUS SOFTWARE
   It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
   
   See this link for a listing of some online & their stand-alone antivirus programs:
   
   Virus, Spyware, and Malware Protection and Removal Resources
   
   It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
   
6. FIREWALL
   Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.
   
   
   
7. Microsoft Windows Update
   Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
   
8. SPYBOT - SEARCH & DESTROY
   Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
   
   
   
9. AD-AWARE
   Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

• Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• Google Toolbar - Get the free google toolbar to help stop pop up windows.
  
  
• CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
  
  
• Winpatrol - Download and install the free version of Winpatrol.
  A tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.