PDA

View Full Version : SOS Please help

Gaelicorby
12 Sep 2006, 3:04pm
Everytime I connect to the internet Avast keeps finding Win32:small-BTH and Win32:Gload. It then deletes the files and everything is fine until the next time I connect and they come. I've tried everything I can think of and I think I am going half insane. Here's the hjt log. Any help would be excellent. Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 14:55:24, on 12/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Paul\Paulsworld\zips\HijackThis.exe

R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RegKillTray] c:\documents and settings\paul\paulsworld\rfree\RegKillTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\System32\ntsystem.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [cwxERSc2X] batatson.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123518870875
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LogWki - Unknown owner - \\?\C:\Program Files\Common Files\Services\com1.exe (file missing)
O23 - Service: LogWsd - Unknown owner - \\?\C:\Program Files\Common Files\Microsoft Shared\lpt1.exe (file missing)
O23 - Service: NetDfe - Unknown owner - \\?\C:\Program Files\Common Files\Services\lpt7.exe (file missing)
O23 - Service: NetMcr - Unknown owner - \\?\C:\Program Files\Common Files\Services\com7.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: nJs - Unknown owner - \\?\C:\Program Files\Common Files\Services\lpt6.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecDgr - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt3.exe (file missing)
O23 - Service: SecKnl - Unknown owner - \\?\C:\Program Files\Common Files\Microsoft Shared\com9.exe (file missing)
O23 - Service: SecPul - Unknown owner - \\?\C:\Program Files\Common Files\System\com3.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: SysBmv - Unknown owner - \\?\C:\Program Files\Common Files\Services\com4.exe (file missing)
O23 - Service: SysCfl - Unknown owner - \\?\C:\Program Files\Common Files\Services\lpt1.exe (file missing)
O23 - Service: SysJbt - Unknown owner - \\?\C:\Program Files\Common Files\Microsoft Shared\com6.exe (file missing)
O23 - Service: SysXmz - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt9.exe (file missing)
O23 - Service: WebExa - Unknown owner - \\?\C:\Program Files\Common Files\System\com8.exe (file missing)
O23 - Service: WebQqu - Unknown owner - \\?\C:\Program Files\Common Files\System\aux.exe (file missing)
O23 - Service: WebQur - Unknown owner - \\?\C:\Program Files\Common Files\System\com2.exe (file missing)
O23 - Service: WinEqh - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt8.exe (file missing)
O23 - Service: WinLgm - Unknown owner - \\?\C:\Program Files\Common Files\System\com7.exe (file missing)
O23 - Service: WinVaw - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt5.exe (file missing)
SpywareShooter
16 Sep 2006, 1:55am
[STEP 1] Fix HijackThis Entries:
Fix the following entries with HijackThis by placing checkmarks in the boxes next to them and clicking "Fix Checked".
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\System32\ntsystem.exe (TROJAN.AGENT.HG) (http://www.spywareshooter.com/hjt/entries/O4/ntsystemgwiz.html)
O4 - HKCU\..\Run: [cwxERSc2X] batatson.exe
O23 - Service: LogWki - Unknown owner - \\?\C:\Program Files\Common Files\Services\com1.exe (file missing)
O23 - Service: LogWsd - Unknown owner - \\?\C:\Program Files\Common Files\Microsoft Shared\lpt1.exe (file missing)
O23 - Service: NetDfe - Unknown owner - \\?\C:\Program Files\Common Files\Services\lpt7.exe (file missing)
O23 - Service: NetMcr - Unknown owner - \\?\C:\Program Files\Common Files\Services\com7.exe (file missing)
O23 - Service: nJs - Unknown owner - \\?\C:\Program Files\Common Files\Services\lpt6.exe (file missing)
O23 - Service: SecDgr - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt3.exe (file missing)
O23 - Service: SecKnl - Unknown owner - \\?\C:\Program Files\Common Files\Microsoft Shared\com9.exe (file missing)
O23 - Service: SecPul - Unknown owner - \\?\C:\Program Files\Common Files\System\com3.exe (file missing)
O23 - Service: SysBmv - Unknown owner - \\?\C:\Program Files\Common Files\Services\com4.exe (file missing)
O23 - Service: SysCfl - Unknown owner - \\?\C:\Program Files\Common Files\Services\lpt1.exe (file missing)
O23 - Service: SysJbt - Unknown owner - \\?\C:\Program Files\Common Files\Microsoft Shared\com6.exe (file missing)
O23 - Service: SysXmz - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt9.exe (file missing)
O23 - Service: WebExa - Unknown owner - \\?\C:\Program Files\Common Files\System\com8.exe (file missing)
O23 - Service: WebQqu - Unknown owner - \\?\C:\Program Files\Common Files\System\aux.exe (file missing)
O23 - Service: WebQur - Unknown owner - \\?\C:\Program Files\Common Files\System\com2.exe (file missing)
O23 - Service: WinEqh - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt8.exe (file missing)
O23 - Service: WinLgm - Unknown owner - \\?\C:\Program Files\Common Files\System\com7.exe (file missing)
O23 - Service: WinVaw - Unknown owner - \\?\C:\Program Files\Common Files\System\lpt5.exe (file missing)

[STEP 2] Remove Malicious Files:
Locate the following files using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.
C:\WINDOWS\System32\ntsystem.exe
batatson.exe

[STEP 3]Report Back to us:
Once you have followed all of the steps above please reboot your computer and post a new HijackThis log.
Gaelicorby
16 Sep 2006, 5:10pm
I just managed to get rid of it yesterday.Thanks a lot for replying though, ye guys are awesome.