|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-31-2005, 05:09 AM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
Spysheriff and IE problems-Hijackthis log
Hi there, ive been trying to sort this myself for the last two days but only with limited success. I thought the spysheriff had gone but just as i write this the flashing red icon with a cross has reappeared in my toolbar!
I have always used Norton antivirus kept up to date. I have also used Adaware, Spybot S&D, and tried a few manual deletions as per some other advice. I have scanned with Pandasoft which found lots more. IE is painfully slow, always getting hijacked, and also inserts links to random words in most webpages, when i read about CWShredder i thought this is the solution!! but it didnt come up with a thing, despite spybot always finding CWS stuff. Am still getting popups, but i have restored my wallpaper ok. SpybotS&D when fixing probs always gives the message "unexpected error in fixing problems (failed to set data for 'Search Assistant')" Finally, norton and also Spysweeper shield are blocking tons of stuff but obviously not everything. Ithnk thats everything. Hope you can help! Matt THIS IS MY PANDASCAN LOG FIRST...... Incident Status Location Adware:Adware/SearchAid Not desinfected D:\WINDOWS\CRMQ32.EXE Dialer:Dialer.DNA Not desinfected D:\DOCUME~1\MATTYD\LOCALS~1\TEMP\85.TMP.EXE Adware:Adware/SearchAid Not desinfected D:\WINDOWS\crmq32.exe Adware:Adware/Dyfuca Not desinfected C:\Program Files\Ejqngor\Fzharr.exe Adware:adware/adsmart Not desinfected D:\WINDOWS\SYSTEM32\vx.tll Adware:adware/searchaid Not desinfected D:\WINDOWS\sdkjm32.exe Adware:adware/ncase Not desinfected D:\TEMP\FLEOK Adware:adware/wintools Not desinfected Windows Registry Adware:Adware/Dyfuca Not desinfected C:\program files\Ejqngor\Fzharr.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\atlnv.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\iprz.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\appiq32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\winho32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\syssv32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\mslg.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\netht.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\javafd.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\javaro.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\netvu32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\ntfh.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\iedv.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\winns.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\apprl.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\javayf.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\mfcsu.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\msuz32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\atlgb.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\sdkwa.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\ipdn32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\sysre32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\sdkvc.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\sdkgs.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\systy32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\addnr32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\apijl32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\apimx.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\crvg.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\system32\mfcom.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\addar32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\fholha.dat Adware:Adware/SearchAid Not desinfected D:\WINDOWS\ochlwq.txt Adware:Adware/SearchAid Not desinfected D:\WINDOWS\hhwxsq.dat Adware:Adware/SearchAid Not desinfected D:\WINDOWS\fctyso.dat Adware:Adware/SearchAid Not desinfected D:\WINDOWS\zuosyp.dat Adware:Adware/SearchAid Not desinfected D:\WINDOWS\eengsn.dat Adware:Adware/SearchAid Not desinfected D:\WINDOWS\addnx32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\ipgu32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\msxm.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\winfy32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mfchs32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\d3kp.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\netra.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\winny32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\msbe.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mfclq32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\javadm.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\crng32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\winaj.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\crmu32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\netye.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mfcxs.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\d3yd32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\crlx.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\crmq32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mssm32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\atlyx.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\sdkjm32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\atlmw.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mfckl32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\winlg32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\sysug32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\msfk.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\nwmxdg.dat Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mfcxf.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\sdkvv32.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\msxf.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\mspn.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\atlcn.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\apima.exe Adware:Adware/SearchAid Not desinfected D:\WINDOWS\addju32.exe Dialer:Dialer.DNA Not desinfected D:\Documents and Settings\MATTYD\Local Settings\Temp\85.tmp Dialer:Dialer.DNA Not desinfected D:\Documents and Settings\MATTYD\Local Settings\Temp\85.tmp.exe Virus:Trj/Mitglieder.EK Disinfected Local Folders\Deleted Items[Work and taxes.rar][Taxes.exe] |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
12-31-2005, 05:11 AM
|
#2 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
AND THIS IS MY HIJACKTHIS LOG..
Logfile of HijackThis v1.99.1 Scan saved at 12:11:39, on 31/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\Norton AntiVirus\navapsvc.exe D:\WINDOWS\System32\nvsvc32.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE C:\Program Files\Ejqngor\Fzharr.exe D:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe D:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe D:\Program Files\MSN Messenger\MsnMsgr.Exe D:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe D:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe D:\WINDOWS\crmq32.exe D:\WINDOWS\system32\crif32.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\William Hill Poker\Poker.exe D:\Program Files\Messenger\msmsgs.exe C:\program files\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://D:\WINDOWS\fvkrd.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WINDOWS\fvkrd.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WINDOWS\fvkrd.dll/sp.html#66987%resultposition.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WINDOWS\fvkrd.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: Class - {405DBEDA-6989-E630-5389-BD3154843F0D} - D:\WINDOWS\ipym.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Class - {8EC08744-822B-83C9-5FD2-0CC2B589B005} - D:\WINDOWS\system32\crpe32.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [MVRescue] C:\MVRescue\mvrescue quit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [eBayToolbar] D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420" O4 - HKLM\..\Run: [Xjrgg] C:\Program Files\Ejqngor\Fzharr.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe O4 - HKLM\..\Run: [MimBoot] D:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [MMTray] "D:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [ipaj32.exe] D:\WINDOWS\ipaj32.exe O4 - HKLM\..\Run: [85.tmp] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [85.tmp.exe] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [adddj.exe] D:\WINDOWS\system32\adddj.exe O4 - HKLM\..\Run: [javaac.exe] D:\WINDOWS\javaac.exe O4 - HKLM\..\Run: [d3im.exe] D:\WINDOWS\system32\d3im.exe O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [crif32.exe] D:\WINDOWS\system32\crif32.exe O4 - HKLM\..\RunOnce: [crmq32.exe] D:\WINDOWS\crmq32.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [STManager] "D:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Spyware Cleaner] "D:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &eBay Search - res://D:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - D:\Program Files\ladbrokesMPP\MPPoker.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-24.cab O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://o2.kodakmobile.co.uk/download...1/axofupld.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C9364447-D3E9-48ED-A198-11AB43DCE29C}: NameServer = 194.168.4.100 194.168.8.100 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe |
|
|
|
|
12-31-2005, 07:39 AM
|
#3 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted.
Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. * * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Download & install - CleanUp.exe (not recommended for WinXP64) Download - About Buster.zip. Unzip to a new folder & update About Buster. Exit the program once that is completed. Download & extract it to it's own folder - smitRem.exe Download and install Ewido Security Suite
'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding. It is IMPORTANT that you don't miss a step & perform everything in the correct order. Please disable Webroot SpySweeper, as it hinders the removal of some entries. You can re-enable it after you're clean. To disable Webroot SpySweeper:
* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * UN-INSTALLING PROGRAMS * * * * * * * * * * * * * * Go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs:
* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": O4 - HKLM\..\Run: [Xjrgg] C:\Program Files\Ejqngor\Fzharr.exe O4 - HKCU\..\Run: [Spyware Cleaner] "D:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab.
* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * CleanUp! will not create any backups!! * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * * Run About Buster and click - Begin Removal. Locate 'Ab LogFile.txt' (... in the same folder as AboutBuster) and post it in your next reply. Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete. * * * * Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply. * * * * Next go to Control Panel click Display>Desktop>Customize Desktop>Website Under the 'Web pages' box, Uncheck everything present. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Perform another online scan with Internet Explorer with Panda ActiveScan
*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. *Turn off the real time scanner of any existing antivirus program while performing the online scan * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
12-31-2005, 08:45 AM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Lol..version 6.0 is the newest & latest version. No update needed
__________________
Question - what have you done for the community today? |
|
|
|
|
01-01-2006, 06:33 AM
|
#6 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
here we go..
ok here we go. The following are the log files requested. Firstly a few notes.
In the Add/Remove programs, Spyware cleaner not listed. Home Search Assistent and Shopping Wizard are listed. I think the rest are ok. Locared and deleted the C:\Programs\Ejqngor but could not find D:\Program Files\Spyware Cleaner Ran Cleanup! ...awesome number of files this beauty found! Great stuff. While running About Buster, i got a box saying "it appears a CWS Infection has been found on your PC. Would you like to reset your internet explorer settings? This will also remove all files from the temp file" Not sure if i should have but i clicked Yes. Next during the same program at the end i had "runtime error '339' Component comctl32.ocx or one of its dependencies is not correctly registered: a file is missing or invalid" No options just clicked ok. I have just located all my logfiles and the file for About Buster is not there. Wonder if this is to do with those messages?? Here are the logfiles... Hijack this Logfile of HijackThis v1.99.1 Scan saved at 17:52:43, on 31/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe D:\WINDOWS\Explorer.EXE D:\Documents and Settings\MATTYD\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: Class - {405DBEDA-6989-E630-5389-BD3154843F0D} - D:\WINDOWS\ipym.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Class - {8EC08744-822B-83C9-5FD2-0CC2B589B005} - D:\WINDOWS\system32\crpe32.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [MVRescue] C:\MVRescue\mvrescue quit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [eBayToolbar] D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420" O4 - HKLM\..\Run: [Xjrgg] C:\Program Files\Ejqngor\Fzharr.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe O4 - HKLM\..\Run: [MimBoot] D:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [MMTray] "D:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [ipaj32.exe] D:\WINDOWS\ipaj32.exe O4 - HKLM\..\Run: [85.tmp] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [85.tmp.exe] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [adddj.exe] D:\WINDOWS\system32\adddj.exe O4 - HKLM\..\Run: [javaac.exe] D:\WINDOWS\javaac.exe O4 - HKLM\..\Run: [d3im.exe] D:\WINDOWS\system32\d3im.exe O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [crif32.exe] D:\WINDOWS\system32\crif32.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [STManager] "D:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Spyware Cleaner] "D:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &eBay Search - res://D:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - D:\Program Files\ladbrokesMPP\MPPoker.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-24.cab O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://o2.kodakmobile.co.uk/download...1/axofupld.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - D:\WINDOWS\crmq32.exe" /s (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Pandascan Incident Status Location Adware:adware/adsmart Not desinfected D:\WINDOWS\SYSTEM32\vx.tll Adware:adware/cws.aboutblank Not desinfected Windows Registry Ewido --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 18:42:05, 31/12/2005 + Report-Checksum: 4325815D + Scan result: HKLM\SOFTWARE\Classes\CLSID\{50B9D537-5DB0-52B1-FF6F-ED6C70DA477E} -> Spyware.CoolWebSearch : Cleaned without backup HKLM\SOFTWARE\Classes\CLSID\{57CEBAAD-4565-C660-5FAF-624E13DBE3B7} -> Spyware.CoolWebSearch : Cleaned without backup HKLM\SOFTWARE\Classes\Common.Buttons -> Spyware.WebSearch : Cleaned without backup HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Cleaned without backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Rotue -> Spyware.InternetOptimizer : Cleaned without backup C:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019726.dll -> Adware.SpySheriff : Cleaned without backup C:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019728.dll -> Spyware.SpywareNo : Cleaned without backup C:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019729.dll -> Adware.SpySheriff : Cleaned without backup C:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019804.exe -> Not-A-Virus.Hoax.Win32.Renos.al : Cleaned without backup C:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019821.exe -> Adware.SpySheriff : Cleaned without backup C:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022840.exe -> Trojan.Small.cy : Cleaned without backup D:\WINDOWS\system32\70tovmto.ini -> Adware.SAHA : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019793.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019794.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019795.exe -> Downloader.Wintool.f : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019801.exe -> Downloader.Small.atl : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019802.exe -> Downloader.Small.cdc : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019803.exe -> Downloader.Small.aqu : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019810.dll -> Spyware.Wintol : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019827.EXE -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP289\A0019828.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0019833.exe -> Downloader.Tibs.bc : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0019840.dll -> Spyware.180Solutions : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0021846.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0021847.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0021853.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022841.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022842.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022843.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022844.dll -> Downloader.Agent.bc : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022846.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022847.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022848.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022849.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022850.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022851.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022852.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022853.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022854.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022855.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022856.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022857.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022858.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022859.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022860.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022861.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022862.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022863.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022864.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022865.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022866.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022867.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022868.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022869.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022870.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022871.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022872.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022873.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022874.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022875.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022876.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022877.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022878.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022879.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022880.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022881.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022882.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022884.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022885.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022886.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022887.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022888.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022889.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022890.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022891.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022892.dll -> Downloader.Agent.bc : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022893.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022895.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022896.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022897.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022898.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022899.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022900.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022901.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022902.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022903.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022904.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022905.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022906.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022907.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022908.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022909.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022910.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022911.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022912.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022913.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022914.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022915.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022916.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022917.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022918.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022919.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022920.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022921.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022922.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022923.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022924.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022925.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022926.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022927.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022928.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022929.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022930.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022931.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022932.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022933.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022934.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022935.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022936.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022937.exe -> Downloader.Agent.td : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022940.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022941.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022942.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022943.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022944.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022945.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022946.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022947.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022948.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022949.exe -> Trojan.Agent.bi : Cleaned without backup D:\System Volume Information\_restore{906ED87E-C9BF-457A-B135-18C03187E11D}\RP290\A0022950.exe -> Trojan.Agent.bi : Cleaned without backup ::Report End |
|
|
|
|
01-01-2006, 09:27 AM
|
#7 (permalink) |
|
Analyst, Security Team
|
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. Also if you have any programs that may prevent system changes (like Spybot's TeaTimer program, Ad-aware's Ad-Watch, and others), make sure you disable them before doing any of the fixes (or accept the changes for the fix we give you when asked by the programs).
Go to My Computer->Tools (or View)->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders (it's Show all files for Windows 98). * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm and then click OK. For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep). Make sure you downloaded, installed, updated and ran these programs (run in Safe Mode) already - Ad-aware, Spybot and Ewido (only if you have Windows 2000 or XP). If you didn't, do them now. For more information, go to http://www.greyknight17.com/spyware.htm Download AboutBuster http://www.greyknight17.com/spy/AboutBuster.zip and unzip the files to a folder on your Desktop. Don't run it yet. Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer and uncheck the same box to enable System Restore. Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingcomputer.com/foru...howtutorial=61 ). Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WINDOWS\system32\devpu.dll/sp.html#66987%resultposition.net R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: Class - {405DBEDA-6989-E630-5389-BD3154843F0D} - D:\WINDOWS\ipym.dll O2 - BHO: Class - {8EC08744-822B-83C9-5FD2-0CC2B589B005} - D:\WINDOWS\system32\crpe32.dll O4 - HKLM\..\Run: [Xjrgg] C:\Program Files\Ejqngor\Fzharr.exe O4 - HKLM\..\Run: [ipaj32.exe] D:\WINDOWS\ipaj32.exe O4 - HKLM\..\Run: [85.tmp] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [85.tmp.exe] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [adddj.exe] D:\WINDOWS\system32\adddj.exe O4 - HKLM\..\Run: [javaac.exe] D:\WINDOWS\javaac.exe O4 - HKLM\..\Run: [d3im.exe] D:\WINDOWS\system32\d3im.exe O4 - HKLM\..\Run: [crif32.exe] D:\WINDOWS\system32\crif32.exe O4 - HKCU\..\Run: [Spyware Cleaner] "D:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - D:\WINDOWS\crmq32.exe" /s (file missing) Run AboutBuster and click Begin Removal. Once that's done, just hit the OK button. Click Exit once you are done. Click the OK button and it should exit. Open up the 'Ab LogFile.txt' (which was created in the same folder as AboutBuster) and post the log here. Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them): C:\Program Files\Ejqngor\ D:\Program Files\Spyware Cleaner\ D:\WINDOWS\crmq32.exe D:\WINDOWS\ipaj32.exe D:\WINDOWS\ipym.dll D:\WINDOWS\javaac.exe D:\WINDOWS\system32\adddj.exe D:\WINDOWS\system32\crif32.exe D:\WINDOWS\system32\crpe32.dll D:\WINDOWS\system32\d3im.exe D:\WINDOWS\system32\devpu.dll D:\WINDOWS\SYSTEM32\vx.tll Run the CleanUp program again... Restart and run a new Panda scan. Post the log here along with a new HijackThis log.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. |
|
|
|
|
01-01-2006, 10:45 AM
|
#8 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Matt783,
Please carry out GreyKnight's instructions. Before doing so, please go to About Buster's folder & locate Readme.rtf Within it, you shall find instructions similar to this.. Quote:
__________________
Question - what have you done for the community today? |
|
|
|
|
|
01-01-2006, 01:29 PM
|
#9 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
Hi thanks for your replys
Subs...sorry should have read the 'readme' file! However, having downloaded it, i find that my windows\system32 folders are in D: drive not my C: and when i try to run it from the system32 folder as per instructions, im getting "DllregisterServer in comctl32.ocx succeeded". Is this ok?? My C drive is MVRESCUE and D is XPHOME. Matt |
|
|
|
|
01-01-2006, 01:36 PM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Run About Buster from Safe Mode & then post the resultant log & a new HJT log
__________________
Question - what have you done for the community today? |
|
|
|
|
01-01-2006, 02:39 PM
|
#11 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
Hi here are the logs SUBS. Both competed in safe mode...
AboutBuster 6.0 Scan started on [01/01/2006] at [21:27:23] ------------------------------------------------------------- Internet Explorer Instances Terminated! HomeSearch Service stopped if present ------------------------------------------------------------- Streams(ADS) not scanned: System not NTFS ------------------------------------------------------------- No Files Found! ------------------------------------------------------------- Scan was COMPLETED SUCCESSFULLY at 21:29:12 Logfile of HijackThis v1.99.1 Scan saved at 21:34:24, on 01/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe D:\WINDOWS\Explorer.EXE D:\Documents and Settings\MATTYD\Desktop\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: Class - {405DBEDA-6989-E630-5389-BD3154843F0D} - D:\WINDOWS\ipym.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Class - {8EC08744-822B-83C9-5FD2-0CC2B589B005} - D:\WINDOWS\system32\crpe32.dll (file missing) O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [MVRescue] C:\MVRescue\mvrescue quit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [eBayToolbar] D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420" O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe O4 - HKLM\..\Run: [MimBoot] D:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [MMTray] "D:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [ipaj32.exe] D:\WINDOWS\ipaj32.exe O4 - HKLM\..\Run: [85.tmp] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [85.tmp.exe] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [adddj.exe] D:\WINDOWS\system32\adddj.exe O4 - HKLM\..\Run: [javaac.exe] D:\WINDOWS\javaac.exe O4 - HKLM\..\Run: [d3im.exe] D:\WINDOWS\system32\d3im.exe O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [STManager] "D:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &eBay Search - res://D:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - D:\Program Files\ladbrokesMPP\MPPoker.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-24.cab O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://o2.kodakmobile.co.uk/download...1/axofupld.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe |
|
|
|
|
01-01-2006, 02:48 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Ermm... we prefer HJT logs from Normal Mode.
Please ensure Spysweeper is disabled before proceeding... Have HijackThis fix these: R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: Class - {405DBEDA-6989-E630-5389-BD3154843F0D} - D:\WINDOWS\ipym.dll (file missing) O2 - BHO: Class - {8EC08744-822B-83C9-5FD2-0CC2B589B005} - D:\WINDOWS\system32\crpe32.dll (file missing) O4 - HKLM\..\Run: [ipaj32.exe] D:\WINDOWS\ipaj32.exe O4 - HKLM\..\Run: [85.tmp] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [85.tmp.exe] D:\DOCUME~1\MATTYD\LOCALS~1\Temp\85.tmp.exe O4 - HKLM\..\Run: [adddj.exe] D:\WINDOWS\system32\adddj.exe O4 - HKLM\..\Run: [javaac.exe] D:\WINDOWS\javaac.exe O4 - HKLM\..\Run: [d3im.exe] D:\WINDOWS\system32\d3im.exe Then Perform an online scan with Internet Explorer with Panda ActiveScan
*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. *Turn off the real time scanner of any existing antivirus program while performing the online scan Please reboot your computer before posting a new HJT log
__________________
Question - what have you done for the community today? |
|
|
|
|
01-01-2006, 03:44 PM
|
#13 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
Ok here is Panda scan log and HJT in normal mode...
Incident Status Location Adware:adware/adsmart Not desinfected D:\WINDOWS\SYSTEM32\vx.tll Adware:adware/cws.aboutblank Not desinfected Windows Registry Logfile of HijackThis v1.99.1 Scan saved at 22:44:38, on 01/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\ewido anti-malware\ewidoctrl.exe D:\Program Files\Norton AntiVirus\navapsvc.exe D:\WINDOWS\System32\nvsvc32.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE D:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe D:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe D:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe D:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe D:\Program Files\MSN Messenger\MsnMsgr.Exe D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe D:\WINDOWS\system32\wuauclt.exe D:\Program Files\Messenger\msmsgs.exe D:\Documents and Settings\MATTYD\Desktop\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - D:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [MVRescue] C:\MVRescue\mvrescue quit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [eBayToolbar] D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420" O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe O4 - HKLM\..\Run: [MimBoot] D:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [MMTray] "D:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [STManager] "D:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &eBay Search - res://D:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - D:\Program Files\Noble Poker\casino.exe O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - D:\Program Files\ladbrokesMPP\MPPoker.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-24.cab O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://o2.kodakmobile.co.uk/download...1/axofupld.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C9364447-D3E9-48ED-A198-11AB43DCE29C}: NameServer = 194.168.4.100 194.168.8.100 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe |
|
|
|
|
01-01-2006, 11:39 PM
|
#14 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Please delete this file - D:\WINDOWS\SYSTEM32\vx.tll
Download CWShredder Here to its own folder. Update CWShredder
Please tell me how your machine is behaving now. Do you still have anymore issues?
__________________
Question - what have you done for the community today? |
|
|
|
|
01-02-2006, 05:57 AM
|
#15 (permalink) |
|
Registered User
Join Date: Dec 2005
Posts: 11
OS: XP
|
The final couple of problems appear to have been solved, which were slow load up of desk top items and slow loading of IE. Also no popups for at least 24 hours.
Thankyou very very much. This resource and forum is invaluable. I shall be making a donation. Thankyou once again. Matt Just Finally while i think of it, which protection would you suggest and how many programs?? Just your opinion as im sure there are so many it would be impossible to run them all!. |
|
|
|
|
01-02-2006, 07:10 AM
|
#16 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,483
OS: N/A
|
Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
Will do
