Hi,
I need help removing some persistent malware from my family's computer.
When I first began, they had obviously installed a rogue antispyware software, xp antispyware 2009, as it was constantly popping up messages in the taskbar, and had hijacked xp's security center. Our internet explorer was also completely hijacked running random sound bits on its own and displaying random popups as soon as I connected to the internet.
I ran spybot search and destroy and removed the bad entries it found, to no avail (everything came back after I restarted).
I tried unchecking any suspicous entries in my msconfig file (facegame, getpack24, gool, all the wmsncs entries), only to have them all come back after a restart. I tried using spybot's teatimer to block any entries these programs tried to create, to no avail. SuperAntiSpyware was also used to no avail.
I then tried using Malwarebyte's anti-malware software, and removed all the bad entries listed. After a restart I got a message claiming the lsass could not be found, and I couldn't boot windows. I went back to last known good configuration and was able to boot from that. Afterwards, though, I couldn't access anything in windows explorer or internet explorer. Whenever I try to access control panel or browse the contents of any of this PC's drives I get an the following error message:
"Windows cannot find "'C:\WINDOWS\fonts\wmsncs.exe"'. Make sure you typed the name correctly, and then try again..."
When I try to access internet explorer, I get nothing whatsoever (no error message, no startup, just nothing). I'm currently running off Mozilla's Firefox 3 browser.
I was able to successfully access the PCs file system in safe mode, as well as start up internet explorer (I took this opportunity to clear out the cache). Still had the same problems in normal mode. Now the entries for Gool, Facegame, getpack24 and wmsncs no longer show up in the msconfig file. Anything related to xp antispyware 2009 seems to be absent as well.
I checked my most recent HijackThis log, and I still have a persisting entry for wmsncs. Here's the logfile:
____________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:42:21 AM, on 30/11/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
F2 - REG:system.ini: Shell=explorer.exe "C:\WINDOWS\Fonts\wmsncs.exe"
O2 - BHO: (no name) - {5d7b6baa-891e-4fe2-adbf-a775d666df47} - C:\WINDOWS\System32\magagovi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
O4 - HKCU\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7809E9F-5808-4B29-9A82-D7675534BBD5}: NameServer = 207.164.234.129 207.164.234.193
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 3478 bytes
And here's the DSS log file:
____________________________________________________________
DDS (Version 1.0)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 21/03/2002 7:21:28 PM
System Uptime: 30/11/2008 3:31:02 AM (0 hours ago)
Motherboard: IBM | | IBM
Processor: Intel(R) Pentium(R) 4 CPU 1.80GHz | WMT478/NWD | 1794/100mhz
BIOS: PhoenixBIOS 4.0 Release 6.0 for IBM NetVista. | PTLTD - 60400d0 | 20KT46AUS |
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 36 GiB total, 27.367 GiB free.
D: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP16: 14/10/2008 2:12:10 AM - System Checkpoint
RP17: 17/10/2008 7:45:07 PM - System Checkpoint
RP18: 18/10/2008 10:16:55 PM - System Checkpoint
RP19: 19/10/2008 10:22:07 PM - System Checkpoint
RP20: 20/10/2008 10:26:08 PM - System Checkpoint
RP21: 08/11/2008 2:08:55 AM - System Checkpoint
RP22: 09/11/2008 12:20:10 PM - System Checkpoint
RP23: 15/11/2008 12:55:23 PM - System Checkpoint
RP24: 16/11/2008 1:18:32 PM - System Checkpoint
RP25: 29/11/2008 11:37:53 PM - Installed SUPERAntiSpyware Free Edition
RP26: 30/11/2008 2:09:01 AM - ComboFix created restore point
==== Installed Programs ======================
Sansa Media Converter
Access IBM
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player Plugin
ConfigSafe
Contextual Tool Adsoftinc
Default
HijackThis 2.0.2
Intel(R) PRO Ethernet Adapter and Software
Intel(R) PROSet II
Malwarebytes' Anti-Malware
Microsoft Internet Explorer 6 SP1
Microsoft Office 2000 SR-1 Professional
Mozilla Firefox (3.0.4)
NVIDIA Windows 2000/XP Display Drivers
RON Tool Adsoftinc
Sansa Media Converter
Shockwave
SoundMAX
Spybot - Search & Destroy
Starcraft
SUPERAntiSpyware Free Edition
Sympatico 4.73
Sympatico NetAssistant
Uninstall PC-Doctor
WebFldrs XP
Windows Media Format Runtime
==== Event Viewer Messages ===================
24/11/2008 9:14:07 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
==== End Of File ===========================
Any help you can provide would be appreciated.
I need help removing some persistent malware from my family's computer.
When I first began, they had obviously installed a rogue antispyware software, xp antispyware 2009, as it was constantly popping up messages in the taskbar, and had hijacked xp's security center. Our internet explorer was also completely hijacked running random sound bits on its own and displaying random popups as soon as I connected to the internet.
I ran spybot search and destroy and removed the bad entries it found, to no avail (everything came back after I restarted).
I tried unchecking any suspicous entries in my msconfig file (facegame, getpack24, gool, all the wmsncs entries), only to have them all come back after a restart. I tried using spybot's teatimer to block any entries these programs tried to create, to no avail. SuperAntiSpyware was also used to no avail.
I then tried using Malwarebyte's anti-malware software, and removed all the bad entries listed. After a restart I got a message claiming the lsass could not be found, and I couldn't boot windows. I went back to last known good configuration and was able to boot from that. Afterwards, though, I couldn't access anything in windows explorer or internet explorer. Whenever I try to access control panel or browse the contents of any of this PC's drives I get an the following error message:
"Windows cannot find "'C:\WINDOWS\fonts\wmsncs.exe"'. Make sure you typed the name correctly, and then try again..."
When I try to access internet explorer, I get nothing whatsoever (no error message, no startup, just nothing). I'm currently running off Mozilla's Firefox 3 browser.
I was able to successfully access the PCs file system in safe mode, as well as start up internet explorer (I took this opportunity to clear out the cache). Still had the same problems in normal mode. Now the entries for Gool, Facegame, getpack24 and wmsncs no longer show up in the msconfig file. Anything related to xp antispyware 2009 seems to be absent as well.
I checked my most recent HijackThis log, and I still have a persisting entry for wmsncs. Here's the logfile:
____________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:42:21 AM, on 30/11/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
F2 - REG:system.ini: Shell=explorer.exe "C:\WINDOWS\Fonts\wmsncs.exe"
O2 - BHO: (no name) - {5d7b6baa-891e-4fe2-adbf-a775d666df47} - C:\WINDOWS\System32\magagovi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP.EXE
O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX.EXE -CHECK
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
O4 - HKCU\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7809E9F-5808-4B29-9A82-D7675534BBD5}: NameServer = 207.164.234.129 207.164.234.193
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 3478 bytes
And here's the DSS log file:
____________________________________________________________
DDS (Version 1.0)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 21/03/2002 7:21:28 PM
System Uptime: 30/11/2008 3:31:02 AM (0 hours ago)
Motherboard: IBM | | IBM
Processor: Intel(R) Pentium(R) 4 CPU 1.80GHz | WMT478/NWD | 1794/100mhz
BIOS: PhoenixBIOS 4.0 Release 6.0 for IBM NetVista. | PTLTD - 60400d0 | 20KT46AUS |
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 36 GiB total, 27.367 GiB free.
D: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP16: 14/10/2008 2:12:10 AM - System Checkpoint
RP17: 17/10/2008 7:45:07 PM - System Checkpoint
RP18: 18/10/2008 10:16:55 PM - System Checkpoint
RP19: 19/10/2008 10:22:07 PM - System Checkpoint
RP20: 20/10/2008 10:26:08 PM - System Checkpoint
RP21: 08/11/2008 2:08:55 AM - System Checkpoint
RP22: 09/11/2008 12:20:10 PM - System Checkpoint
RP23: 15/11/2008 12:55:23 PM - System Checkpoint
RP24: 16/11/2008 1:18:32 PM - System Checkpoint
RP25: 29/11/2008 11:37:53 PM - Installed SUPERAntiSpyware Free Edition
RP26: 30/11/2008 2:09:01 AM - ComboFix created restore point
==== Installed Programs ======================
Sansa Media Converter
Access IBM
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player Plugin
ConfigSafe
Contextual Tool Adsoftinc
Default
HijackThis 2.0.2
Intel(R) PRO Ethernet Adapter and Software
Intel(R) PROSet II
Malwarebytes' Anti-Malware
Microsoft Internet Explorer 6 SP1
Microsoft Office 2000 SR-1 Professional
Mozilla Firefox (3.0.4)
NVIDIA Windows 2000/XP Display Drivers
RON Tool Adsoftinc
Sansa Media Converter
Shockwave
SoundMAX
Spybot - Search & Destroy
Starcraft
SUPERAntiSpyware Free Edition
Sympatico 4.73
Sympatico NetAssistant
Uninstall PC-Doctor
WebFldrs XP
Windows Media Format Runtime
==== Event Viewer Messages ===================
24/11/2008 9:14:07 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
==== End Of File ===========================
Any help you can provide would be appreciated.
