[coast123]

I have been battling with spysherrif, i tried the self help topic you guys have but to no avail. when i tried to fix my reg. an error popped up. i'm also getting explorer.exe errors and svchost errors. i've got my hjt log for you guys, and if you could help me that would be great.



Logfile of HijackThis v1.99.1
Scan saved at 4:09:49 PM, on 12/15/2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Win32waex\mstss32wa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\System32\lexpps.exe
C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
C:\WINNT\System32\mrtMngr.EXE
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS13
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://theonlybookmark.com/in.cgi?15
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: IexploreOmea - {09628AAA-66AD-4FA2-82E2-698185B66463} - (no file)
O2 - BHO: (no name) - {1C0206A5-4F6F-4FAD-BDCE-AD9A0C8463Ce} - C:\WINNT\System32\ljferomo.dll (file missing)
O2 - BHO: (no name) - {921BD7DB-7E52-4294-B8C5-684434277B28} - C:\WINNT\System32\ljferomo.dll (file missing)
O2 - BHO: SysMon Class - {D5EFDB0E-4F51-414F-B740-54A5C87A8957} - C:\DOCUME~1\FARMER~1\LOCALS~1\Temp\accute.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mstss] C:\Program Files\Win32waex\mstss32wa.exe
O4 - HKLM\..\Run: [qfyqakn.dll] C:\WINNT\System32\rundll32.exe "C:\Documents and Settings\Administrator\Local Settings\Application Data\qfyqakn.dll",xysmkvf
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [LexPPS.exe] C:\WINNT\System32\lexpps.exe
O4 - HKLM\..\RunServices: [updwebmin] c:\winnt\system32\updwebmin.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv8] c:\winnt\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [0mcamcap] C:\WINNT\System32\0mcamcap.exe
O4 - HKCU\..\Run: [updwebmin] c:\winnt\system32\updwebmin.exe
O4 - HKCU\..\Run: [D:\Downloads\plugins\FeedReader30\feedreader.exe] D:\Downloads\plugins\FeedReader30\feedreader.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.exe"
O4 - HKCU\..\Run: [Tristana] "D:\Downloads\Tristana RSS Reader\Reader.exe"
O4 - HKCU\..\Run: [_mzu_stonedrv8] c:\winnt\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [Nord] C:\WINNT\System32\nordsys.exe
O4 - HKCU\..\Run: [taskdir] C:\WINNT\System32\taskdir.exe
O4 - HKCU\..\Run: [system spool] C:\WINNT\System32\syspools.exe
O4 - HKCU\..\Run: [WinMedia] "C:\sudicbx2462530.exe "
O4 - HKCU\..\Run: [WinUpgrade] "C:\sudicbx150075.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\sudicbx6173146.exe "
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\FARMER~1\LOCALS~1\Temp\AF.tmp
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\FARMER~1\LOCALS~1\Temp\svchost.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Feed to Tristana RSS Reader - res://D:\Downloads\Tristana RSS Reader\Reader.exe/AddContent.js
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166215114608
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll
O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINNT\System32\vohb32.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\System32\msasvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

 

[Glaswegian]

Hi coast123 and welcome to TSF.

My name is Iain and I will be helping you clean your system.

You have numerous infections so this will take some work to clean out.

You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your system is clean.

If there is anything you don't understand, please ask BEFORE proceeding with the fixes.

Please ensure that you follow the instructions in the order I have them listed.


Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!


I see you already have AVG Anti Spyware. Please update AVG to the latest definition files.

• Double-click the icon on Desktop to launch AVG Anti Spyware.
• On the top of the main screen click Shield
• Click the word active to change it to inactive
• On the top of the main screen click Update.
• Then click on Start Update.
• After the update finishes (the status bar at the bottom will display "Update successful")
• select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
• Under "Reports"
• Select "Automatically generate report after every scan"
• Un-Select "Only if threats were found"

When you have finished updating, EXIT AVG Anti Spyware. DO NOT scan yet.


Please download SmitfraudFix (by S!Ri)
to your Desktop. Do not use it yet!


Please download combofix.exe to your desktop.

IMPORTANT - You must place combofix on your desktop!!


Double click combofix.exe & follow the prompts.

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.



Services
Click Start->Run - type SERVICES.MSC & then click on the OK button

• Locate the service - MsaSvc
• Double-click on it to open the Properties dialog.
  • Under the General tab, Stop the service by using the Stop button.
• Change the Startup type to Disabled & then click on the OK button

• Then start HiJackThis & go to Config>Misc.Tools...> Delete an NT service...
• In the popup box that appears, copy/paste MsaSvc and then click on the OK button

.



Reboot
Reboot your system in Safe Mode.

• Restart the computer. The computer begins processing a set of instructions known as BIOS.
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
• Instead of Windows loading as normal, a menu should appear
• Use the arrow key to highlight Safe Mode and press Enter.

Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

SpySheriff



HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

O2 - BHO: (no name) - {1C0206A5-4F6F-4FAD-BDCE-AD9A0C8463Ce} - C:\WINNT\System32\ljferomo.dll (file missing)
O2 - BHO: (no name) - {921BD7DB-7E52-4294-B8C5-684434277B28} - C:\WINNT\System32\ljferomo.dll (file missing)
O2 - BHO: SysMon Class - {D5EFDB0E-4F51-414F-B740-54A5C87A8957} - C:\DOCUME~1\FARMER~1\LOCALS~1\Temp\accute.dll (file missing)
O4 - HKLM\..\Run: [mstss] C:\Program Files\Win32waex\mstss32wa.exe
O4 - HKLM\..\Run: [qfyqakn.dll] C:\WINNT\System32\rundll32.exe "C:\Documents and Settings\Administrator\Local Settings\Application Data\qfyqakn.dll",xysmkvf
O4 - HKLM\..\RunServices: [updwebmin] c:\winnt\system32\updwebmin.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv8] c:\winnt\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [updwebmin] c:\winnt\system32\updwebmin.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.exe"
O4 - HKCU\..\Run: [_mzu_stonedrv8] c:\winnt\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [Nord] C:\WINNT\System32\nordsys.exe
O4 - HKCU\..\Run: [system spool] C:\WINNT\System32\syspools.exe
O4 - HKCU\..\Run: [WinUpgrade] "C:\sudicbx150075.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\sudicbx6173146.exe "
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\FARMER~1\LOCALS~1\Temp\AF.tmp
O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\FARMER~1\LOCALS~1\Temp\svchost.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINNT\System32\vohb32.dll (file missing)

Please remember to close all other windows, including browsers then click Fix checked.



File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\Win32waex
C:\Documents and Settings\Administrator\Local Settings\Application Data\qfyqakn.dll
c:\winnt\system32\updwebmin.exe
c:\winnt\system32\_mzu_stonedrv8.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.exe
C:\WINNT\System32\nordsys.exe
C:\WINNT\System32\syspools.exe
C:\ sudicbx150075.exe <- - Go to Start > Search to find this file
C:\ sudicbx6173146.exe <- - Go to Start > Search to find this file
C:\Program Files\SpySheriff



Run SmitfraudFix
Double-click on SmitfraudFix.exe to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply.



Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users
• Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.



Go to Control Panel click Display > Desktop > Customize Desktop > Web > Now, Uncheck Everything and delete if present:
• "Security Info"
• "Warning Message"
• "Security Desktop"
• "Warning Homepage"
• "Desktop Uninstall"

Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK.


Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.



Run AVG Anti Spyware
Run AVG with it's updated definitions...it's important that all windows must be closed)

• Click Scanner
• Click on the Scan tab
• Click Complete System Scan to begin scanning.
• When the scan is complete click Recommended Action and change it to Quarantine
• Then click Apply all actions

Once finished, click the Save report button, then click Save Report As and save it to your desktop.

NOTE: AVG scan may require an hour.



Reboot
Reboot your system in Normal Mode.



SmitfraudFix - Additional Items
Double-click on SmitfraudFix.exe to start the tool.
Select option #3 - Delete Trusted zone by typing 3 and press Enter
**Note** This will remove all entries in the "Trusted Zone" - if you want them back, you have to add them back to the Trusted Sites again.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.




Online Scan
Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on
   located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on
  then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan



Logs required
c:combofix.txt
c:\rapport.txt
AVG Log
Panda Log
HijackThis Log

Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.