HJT Log

P Caftdunt · 01-07-2006, 09:13 AM

Hi, this is my first Hijack This Log. Please can you check it for problems?

I don't have any specific issues i just thought it was time to do some spring cleaning. You should know i have followed the 5 steps before posting this log.
However, there are couple of problems.
1- add/remove tab does not remove a "mywebsearch" thing i have appeared to pick up.. when i go to remove it i get this message "Error Loading C:\PROGRA~1\MYWEBS~1\bar|1.bin\mwsbar.dll The specified module could not be found!
2- i have SP2 on XP.. step 5 http://www.techsupportforum.com/hija...ijackthis.html says install on disinfected system.. i dont know if i have done this.

I hope this makes sense.. here is my log for checking. Thanks,

Logfile of HijackThis v1.99.1
Scan saved at 16:54:47, on 07/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.328\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/radio/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft Windows Update] C:\WINDOWS\system32\msupdate.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

greyknight17 · 01-07-2006, 11:52 AM

Welcome to TSF.

Did you run HijackThis scan in Normal Mode?

Yes, you installed SP2 properly

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Before you do anything else, please create a folder for HijackThis and put it in a permanent folder (like C:\HJT) instead of the Temp folder. This is required because HijackThis will create backups and we don't want them to be deleted.

Please download Ewido Security Suite at http://www.ewido.net/en/download/.

1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'.
8. Exit Ewido. DO NOT scan yet.

If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually.

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Don't run it yet.

Go into HijackThis->Config->Misc Tools->Open Uninstall Manager and click on MyWebSearch. Click on Delete this entry button.

Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingcomputer.com/foru...howtutorial=61 ).

CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

Now open Ewido and do a scan on your system.

* Click on scanner.
* Click on 'Complete System Scan' and the scan will begin.
* While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.
Exit Ewido when it's done.
* Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'.
* Click 'Save report'.
* Save the report to your desktop.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Microsoft Windows Update] C:\WINDOWS\system32\msupdate.exe

Locate and delete the following:

C:\WINDOWS\system32\msupdate.exe
C:\PROGRA~1\MYWEBS~1\

Restart your computer to get back to Normal Mode. Post the Ewido report and a new HijackThis log here.

P Caftdunt · 01-08-2006, 07:41 AM

Hi,
thanks for the swift reply and the easy to follow instructions (i thought my pc was fairly clean! I run adaware and spybot and never find owt!).

I ran the initial HJT in safe mode.

I followed your instructions, the only thing is i could not find
C:\WINDOWS\system32\msupdate.exe
C:\PROGRA~1\MYWEBS~1\
to delete them- i'm pretty certain i have checked thoroughly.

Here are the current logs:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 15:13:18, 08/01/2006
+ Report-Checksum: 781C6F7

+ Scan result:

C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3CJPEG.DLL -> Spyware.FunWeb : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3DTACTL.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3HISTSW.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3HTMLMU.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3HTTPCT.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3POPSWT.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3PSSAVR.SCR -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3REPROX.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3RESTUB.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3SCHMON.EXE -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3SCRCTR.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3WPHOOK.DLL -> Spyware.Wesbar : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3HTML.DLL -> Adware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3IDLE.DLL -> Adware.IWon : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3OUTLCN.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3PLUGIN.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3SKIN.DLL -> Adware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\MWSOEMON.EXE -> Spyware.Wesbar : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\MWSOESTB.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\NPMYWEBS.DLL -> Spyware.MyWebSearch : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba2106.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\nat3.exe -> Downloader.Small.bci : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\dba1878.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\dba2106.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\gba2106.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\gba851.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\gsa0932.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\nat3.exe -> Downloader.Small.bci : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\UWFX5_0001_N53L1025NetInstaller.exe -> Not-A-Virus.Downloader.Agent.f : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\UWFX5_0001_N56M0311NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Cleaned with backup
C:\WINDOWS\mdkiaf.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Cleaned with backup
C:\WINDOWS\system32\fvp.dll -> Downloader.Agent.oc : Cleaned with backup
C:\WINDOWS\system32\wuamgrd.exe -> Backdoor.SdBot.ig : Cleaned with backup

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 15

41, on 08/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/radio/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CS2\Services\Tcpip\..\{4174B9D4-AB39-4BB6-A2BA-0BC76B8A60DB}: NameServer = 194.72.0.114 62.6.40.162
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

cheers.

greyknight17 · 01-08-2006, 06:33 PM

Empty your Recycle Bin now.

Your log is clean.

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.

P Caftdunt · 01-09-2006, 11:15 AM

You are a superstar.. i appreciate all your help. I hope you don't mind but i have recommended you lot to my mates.

I am having a problem burning stuff to cd/dvd which i have never had before! but i will have another tinker myself and if i have any problems i'll be back.

Thanks again.

01-07-2006, 09:13 AM	#1 (permalink)
P Caftdunt Registered User Join Date: Jan 2006 Posts: 17 OS: XP	HJT Log Hi, this is my first Hijack This Log. Please can you check it for problems? I don't have any specific issues i just thought it was time to do some spring cleaning. You should know i have followed the 5 steps before posting this log. However, there are couple of problems. 1- add/remove tab does not remove a "mywebsearch" thing i have appeared to pick up.. when i go to remove it i get this message "Error Loading C:\PROGRA~1\MYWEBS~1\bar\|1.bin\mwsbar.dll The specified module could not be found! 2- i have SP2 on XP.. step 5 http://www.techsupportforum.com/hija...ijackthis.html says install on disinfected system.. i dont know if i have done this. I hope this makes sense.. here is my log for checking. Thanks, Logfile of HijackThis v1.99.1 Scan saved at 16:54:47, on 07/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.328\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/radio/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Microsoft Windows Update] C:\WINDOWS\system32\msupdate.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

01-07-2006, 11:52 AM	#2 (permalink)
greyknight17 Analyst, Security Team Join Date: Jul 2004 Location: New York Posts: 14,327 OS: Windows 98 & Windows XP Home/Pro My System	Welcome to TSF. Did you run HijackThis scan in Normal Mode? Yes, you installed SP2 properly Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. Before you do anything else, please create a folder for HijackThis and put it in a permanent folder (like C:\HJT) instead of the Temp folder. This is required because HijackThis will create backups and we don't want them to be deleted. Please download Ewido Security Suite at http://www.ewido.net/en/download/. 1. Install Ewido Security Suite. 2. When installing, under 'Additional Options' uncheck: * Install background guard * Install scan via context menu 3. Launch Ewido, there should be an icon on your desktop, double click it. 4. The program will now open to the main screen. 5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment. 6. You will need to update Ewido to the latest definition files. * On the left hand side of the main screen click update. * Then click on Start Update. 7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'. 8. Exit Ewido. DO NOT scan yet. If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Don't run it yet. Go into HijackThis->Config->Misc Tools->Open Uninstall Manager and click on MyWebSearch. Click on Delete this entry button. Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingcomputer.com/foru...howtutorial=61 ). CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff. Now open Ewido and do a scan on your system. * Click on scanner. * Click on 'Complete System Scan' and the scan will begin. * While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK. Exit Ewido when it's done. * Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'. * Click 'Save report'. * Save the report to your desktop. Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [Microsoft Windows Update] C:\WINDOWS\system32\msupdate.exe Locate and delete the following: C:\WINDOWS\system32\msupdate.exe C:\PROGRA~1\MYWEBS~1\ Restart your computer to get back to Normal Mode. Post the Ewido report and a new HijackThis log here. __________________ Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D Anti-Spyware Tutorial :: Spyware Prevention Tools

01-08-2006, 07:41 AM	#3 (permalink)
P Caftdunt Registered User Join Date: Jan 2006 Posts: 17 OS: XP	Hi, thanks for the swift reply and the easy to follow instructions (i thought my pc was fairly clean! I run adaware and spybot and never find owt!). I ran the initial HJT in safe mode. I followed your instructions, the only thing is i could not find C:\WINDOWS\system32\msupdate.exe C:\PROGRA~1\MYWEBS~1\ to delete them- i'm pretty certain i have checked thoroughly. Here are the current logs: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 15:13:18, 08/01/2006 + Report-Checksum: 781C6F7 + Scan result: C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3CJPEG.DLL -> Spyware.FunWeb : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3DTACTL.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3HISTSW.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3HTMLMU.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3HTTPCT.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3POPSWT.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3PSSAVR.SCR -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3REPROX.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3RESTUB.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3SCHMON.EXE -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3SCRCTR.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\F3WPHOOK.DLL -> Spyware.Wesbar : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3HTML.DLL -> Adware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3IDLE.DLL -> Adware.IWon : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3OUTLCN.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3PLUGIN.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\M3SKIN.DLL -> Adware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\MWSOEMON.EXE -> Spyware.Wesbar : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\MWSOESTB.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-606747145-2025429265-725345543-1003\Dc798\bar\1.bin\NPMYWEBS.DLL -> Spyware.MyWebSearch : Cleaned with backup C:\WINDOWS\Downloaded Program Files\CONFLICT.1\dba2106.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\Downloaded Program Files\CONFLICT.1\nat3.exe -> Downloader.Small.bci : Cleaned with backup C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Cleaned with backup C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Cleaned with backup C:\WINDOWS\Downloaded Program Files\dba1878.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\Downloaded Program Files\dba2106.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\Downloaded Program Files\gba2106.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\Downloaded Program Files\gba851.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\Downloaded Program Files\gsa0932.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\Downloaded Program Files\nat3.exe -> Downloader.Small.bci : Cleaned with backup C:\WINDOWS\Downloaded Program Files\UWFX5_0001_N53L1025NetInstaller.exe -> Not-A-Virus.Downloader.Agent.f : Cleaned with backup C:\WINDOWS\Downloaded Program Files\UWFX5_0001_N56M0311NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Cleaned with backup C:\WINDOWS\mdkiaf.exe -> Dialer.Generic : Cleaned with backup C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Cleaned with backup C:\WINDOWS\system32\fvp.dll -> Downloader.Agent.oc : Cleaned with backup C:\WINDOWS\system32\wuamgrd.exe -> Backdoor.SdBot.ig : Cleaned with backup ::Report End Logfile of HijackThis v1.99.1 Scan saved at 1541, on 08/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ewido anti-malware\SecuritySuite.exe C:\HJT\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/radio/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O17 - HKLM\System\CS2\Services\Tcpip\..\{4174B9D4-AB39-4BB6-A2BA-0BC76B8A60DB}: NameServer = 194.72.0.114 62.6.40.162 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe cheers.

01-08-2006, 06:33 PM	#4 (permalink)
greyknight17 Analyst, Security Team Join Date: Jul 2004 Location: New York Posts: 14,327 OS: Windows 98 & Windows XP Home/Pro My System	Empty your Recycle Bin now. Your log is clean. To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided. Are there any problems now? If not, you should be set to go. __________________ Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D Anti-Spyware Tutorial :: Spyware Prevention Tools

01-09-2006, 11:15 AM	#5 (permalink)
P Caftdunt Registered User Join Date: Jan 2006 Posts: 17 OS: XP	You are a superstar.. i appreciate all your help. I hope you don't mind but i have recommended you lot to my mates. I am having a problem burning stuff to cd/dvd which i have never had before! but i will have another tinker myself and if i have any problems i'll be back. Thanks again.