Options

More Spyware fun, help needed :)

Unknown
edited December 2004 in Spyware & Virus Removal
Hello all!

Last time, you guys did an awesome job helping me with my bestfriends virus, so now i'm at it again :)

I know I have some spyware on my computer, I got rid of most of it, because my computer doesn't act up as much. But the a few pop ups are still annoying.

I have run CWShredder, Sypbot, Adaware and Hijack this, and am still redirected on my websites sometimes.

Everytime I turn on my computer, my Symantec Virus program says I have either one of two virus's

A trojan in the file: C:\DOCUME~1\Drew\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\YZRAK3VE\IdleUI[1].dll

Or a trojan here: C:\WINDOWS\system32\IdleUI.dll

and ONCE it said I had this: C:\WINDOWS\systems32\manage.exe
but it hasn't said that one since

So I was just wondering if anyone knows anything about these, or some other things I can do for the spyware, other than what was on the Spyware thing that was already posted, thanks!!!

p.s. Apparently while i was typing this...AdDestroyer and Vitual bouncer just re-installed themselves back onto my computer...they havnen't been there in a few days :(

p.p.s.
Here is my hijack read:
Logfile of HijackThis v1.98.2
Scan saved at 11:53:12 AM, on 11/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\windows\180ax.exe
C:\Program Files\SED\SED.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\system32\elsml2.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\AWS\WeatherBug\Weather.EXE
C:\WINDOWS\system32\dxtdx32.exe
C:\Documents and Settings\Drew\Application Data\osoa.exe
C:\WINDOWS\system32\?ttrib.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\winupdt.exe
C:\WINDOWS\system32\prrtect.exe
C:\WINDOWS\system32\prrtect.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\winupdt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\ADDEST~1\ADDEST~1.EXE
C:\PROGRA~1\VBouncer\VIRTUA~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\RECOMM~1\v15\rh.exe
C:\Documents and Settings\Drew\My Documents\download\Hijack\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\edow.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [180ax] c:\windows\180ax.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [fmpiv] C:\WINDOWS\fmpiv.exe
O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\system32\stcloader.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdtl.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [vsmO3pO] elsml2.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.EXE 1
O4 - HKCU\..\Run: [eB5ERfi4T] dxtdx32.exe
O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\Drew\Application Data\osoa.exe
O4 - HKCU\..\Run: [Fzzythmq] C:\WINDOWS\system32\?ttrib.exe
O4 - HKCU\..\Run: [prrtect] C:\WINDOWS\system32\prrtect.exe
O4 - Startup: AdDestroyer.lnk = C:\Program Files\AdDestroyer\AdDestroyer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: http://login.passport.net
O15 - Trusted Zone: http://www.windowsupdate.com
O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install007.exe
O16 - DPF: {A16E6189-A1DD-4696-9806-0324C145D794} (KeyActivex Control) - http://www.jraun.com/activex/src/KeyActivexTest.ocx

Comments

  • SpywareShooterSpywareShooter 127.0.0.1
    edited November 2004
    O4 - HKLM\..\Run: [180ax] c:\windows\180ax.exe
    O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
    O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
    O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
    O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
    O4 - HKLM\..\Run: [fmpiv] C:\WINDOWS\fmpiv.exe
    O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\system32\stcloader.exe
    O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdtl.exe
    O4 - HKLM\..\Run: [vsmO3pO] elsml2.exe
    O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.EXE 1
    O4 - HKCU\..\Run: [eB5ERfi4T] dxtdx32.exe
    O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\Drew\Application Data\osoa.exe
    O4 - HKCU\..\Run: [Fzzythmq] C:\WINDOWS\system32\?ttrib.exe
    O4 - HKCU\..\Run: [prrtect] C:\WINDOWS\system32\prrtect.exe
    O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install007.exe

    Fix those entries then find and delete the following files:
    c:\windows\180ax.exe
    C:\Program Files\SED\
    stlb2.dll
    E6F1873B.DLL
    C:\WINDOWS\fmpiv.exe
    C:\WINDOWS\system32\stcloader.exe
    C:\WINDOWS\system32\winupdtl.exe
    elsml2.exe
    C:\PROGRA~1\VBouncer\
    C:\Program Files\AWS\
    dxtdx32.exe
    C:\Documents and Settings\Drew\Application Data\osoa.exe
    C:\WINDOWS\system32\?ttrib.exe
    C:\WINDOWS\system32\prrtect.exe

    Then reboot and post a new log.
  • Doozie11d
    edited November 2004
    Okay, some of the files you asked to delete in Hijack were not there...but that may be from other programs i've ran to get rid of stuff.

    But there were also a few that i searched for in safe mode and could not find.

    Like:
    fmpiv.exe
    stcloader.exe
    winupdtl.exe
    elsm12.exe
    dxtdx32.exe

    I found files that were SIMILAR, like...off by a letter, but i left those there


    Also, after deleting all the 180 stuff, a little thing just popped up on my desktop saying "The system has detected that a third-party application has removed 180search assisstant...blah blah blah"

    So i'm just not going to click on it

    and here is my new log:
    Logfile of HijackThis v1.98.2
    Scan saved at 1:37:59 PM, on 11/26/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\AutoUpdate\AutoUpdate.exe
    C:\WINDOWS\system32\batrepl.exe
    C:\WINDOWS\ebwvkj.exe
    C:\Program Files\NaviSearch\bin\nls.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\axd4svc.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Documents and Settings\Drew\My Documents\download\Hijack\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [vsmO3pO] batrepl.exe
    O4 - HKLM\..\Run: [ebwvkj] C:\WINDOWS\ebwvkj.exe
    O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [eB5ERfi4T] axd4svc.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
    O15 - Trusted Zone: http://login.passport.net
    O15 - Trusted Zone: http://www.windowsupdate.com

    :thumbsup:
  • Doozie11d
    edited December 2004
    Alright, even after deleting the stuff you told me too, my computer is running MUCH better, but the BullsEye network crap just won't go away.

    What else should i be deleting?

    Here is a more recent log:

    Logfile of HijackThis v1.98.2
    Scan saved at 1:05:57 PM, on 12/12/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\AutoUpdate\AutoUpdate.exe
    C:\WINDOWS\system32\erssvcs.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\autkinfo.exe
    C:\Program Files\AWS\WeatherBug\Weather.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\CxtPls\CxtPls.exe
    C:\Program Files\BullsEye Network\bin\bargains.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Drew\My Documents\download\Hijack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [vsmO3pO] erssvcs.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [eB5ERfi4T] autkinfo.exe
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
    O15 - Trusted Zone: http://login.passport.net
    O15 - Trusted Zone: http://www.windowsupdate.com


    p.s. You guys are sweeet
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
    O4 - HKLM\..\Run: [vsmO3pO] erssvcs.exe
    O4 - HKCU\..\Run: [eB5ERfi4T] autkinfo.exe
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)

    Fix those entries then find and delete the files listed above, reboot and post a new log.
  • Doozie11d
    edited December 2004
    okay, after fixing all of the files in Hijack, and then going into safe mode, i deleted

    cxtpls.dll
    erssvcs.exe
    and
    autkinfo.exe

    i could not find mscb.dll or msbe.dll, even in safe mode

    and the only weather bug thing i could find was Weatherbug.exe, not the one with (hkcu) after it, so i didn't delete it

    and after restarting my computer, all but the autkinfo.exe are back:
    Logfile of HijackThis v1.98.2
    Scan saved at 1:23:47 AM, on 12/13/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\AutoUpdate\AutoUpdate.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\BullsEye Network\bin\bargains.exe
    C:\Documents and Settings\Drew\My Documents\download\Hijack\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [vsmO3pO] erssvcs.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
    O15 - Trusted Zone: http://login.passport.net
    O15 - Trusted Zone: http://www.windowsupdate.com
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    Set your computer to show hidden files and folders if you haven't done that already.

    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
    O4 - HKLM\..\Run: [vsmO3pO] erssvcs.exe

    Fix those entries then find and delete the files listed above, reboot and post a new log.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    If I can butt in? Bullseye has recently been re-installing itself through services.

    Please download Service Filter

    Extract it to it's own folder.

    Double click on ServiceFilter.vbs. If your antivirus pops up, tell it to allow this script to run.

    A text file called POST_THIS will be in the same folder.

    Please post the contents of POST_THIS into this thread. Post another hijackthis log too.

    If I have not responded and these are showing in the POST_THIS log,

    ZESOFT service
    c:\windows\zeta.exe

    Go to:

    Start > Run > type "services.msc", then click OK

    Scroll down to the ZESOFT service.

    Click it to highlight it, <right-click> and select: Properties
    Select "Service Status" option to "Stop"
    Select: "Startup type" set it to "Disabled", click Apply, then OK.

    CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

    Run Hijack This!
    Click "Scan".


    <Fill in all the nasties!!!!>

    Then click "Fix checked".

    Reboot in "safe" mode.

    Find and delete:

    c:\program files\bullseye network <--- FOLDER

    c:\windows\system32\msbe.dll <--- file
    (should already be deleted - be sure!)

    c:\windows\zeta.exe <--- file

    Some malware files may be "hidden".
    Be sure to show hidden files when looking for these file(s) and/or folder(s).

    Reboot in normal mode and "copy/paste" a new log file into this thread.
  • Doozie11d
    edited December 2004
    Okay, after doing the steps that both of you suggested

    and i also deleted the zete files, and i still couldn't find mscb.dll and msbe.dll, even when i tell my computer to show hidden files, here is my new log and script

    POST THIS:

    The script did not recognize the services listed below.
    This does not mean that they are a problem.

    To copy the entire contents of this document for posting:
    At the top of this window click "Edit" then "Select All"
    Next click "Edit" again then "Copy"
    Now right click in the forum post box then click "Paste"

    ########################################

    ServiceFilter 1.1
    by rand1038

    Microsoft Windows XP Professional
    Version: 5.1.2600 Service Pack 2
    Dec 13, 2004 12:00:18 PM


    ===> Begin Service Listing <===

    Unknown Service #1
    Service Name: DefWatch
    Display Name: DefWatch
    Start Mode: Auto
    Start Name: LocalSystem
    Description: ...
    Service Type: Own Process
    Path: c:\progra~1\symant~1\symant~1\defwatch.exe
    State: Running
    Process ID: 1756
    Started: True
    Exit Code: 0
    Accept Pause: False
    Accept Stop: True

    Unknown Service #2
    Service Name: Norton AntiVirus Server
    Display Name: Symantec AntiVirus Client
    Start Mode: Auto
    Start Name: LocalSystem
    Description: Provides real-time virus scanning, reporting, and management functionality for Symantec Client ...
    Service Type: Own Process
    Path: c:\progra~1\symant~1\symant~1\rtvscan.exe
    State: Running
    Process ID: 1856
    Started: True
    Exit Code: 0
    Accept Pause: False
    Accept Stop: True

    Unknown Service #3
    Service Name: SwPrv
    Display Name: MS Software Shadow Copy Provider
    Start Mode: Manual
    Start Name: LocalSystem
    Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this ...
    Service Type: Own Process
    Path: c:\windows\system32\dllhost.exe /processid:{6d57c146-80be-4c37-89b1-ce7d84c34059}
    State: Stopped
    Process ID: 0
    Started: False
    Exit Code: 1077
    Accept Pause: False
    Accept Stop: False

    Unknown Service # 4
    Service Name: ZESOFT
    Display Name: ZESOFT
    Start Mode: Auto
    Start Name: LocalSystem
    Description: ZESoft ...
    Service Type: Own Process
    Path: c:\windows\zeta.exe
    State: Stopped
    Process ID: 0
    Started: False
    Exit Code: 0
    Accept Pause: False
    Accept Stop: False

    ---> End Service Listing <---

    There are 84 Win32 services on this machine.
    4 were unrecognized.

    Script Execution Time: 1.648438 seconds.



    HIJACK LOG:

    Logfile of HijackThis v1.98.2
    Scan saved at 12:20:07 PM, on 12/13/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\AutoUpdate\AutoUpdate.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Drew\My Documents\download\Hijack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\winlspak.dll
    O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
    O15 - Trusted Zone: http://login.passport.net
    O15 - Trusted Zone: http://www.windowsupdate.com



    things are lookin better :) Just lemme know if anything looks fishy still
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    Your log looks okay now. Are you still having any problems?
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    Download LSPfix from here
    On the opening screen, click the "I know what I'm doing" checkbox. Check all instances of "calsp.dll and winlspak.dll" (and nothing else), and move them to the "Remove" pane. Then click Finish.

    Go to c:\windows\system32 and delete those files manually.

    Open Task Manager & end process on the following:
    AutoUpdate.exe

    Go to C:\Program Files and delete the AutoUpdate folder.

    Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
Sign In or Register to comment.