spyware problems,please help, blue monday

Comments

• Trogan London, UK

  September 2005 edited September 2005

  Hi, have you got anything disabled on startup? If so, please enable them all and post a new HJT log

  0
• blue472

  September 2005 edited September 2005

  Thankyou Trogan,Here is hjt with all startup programs enabled.tom
  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:16:58 AM, on 9/28/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
  C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\WINZIP\winzip32.exe
  C:\unzipped\hijackthis[1]\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [sunasDTServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1118009368170
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
  O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
  O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
  O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
  O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
  O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
  O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

  0
• Trogan London, UK

  September 2005 edited September 2005

  Your log is clean but do the following:
  
  1) Download the Trial Version of Ewido Security Suite. Once installed, click 'update' and update Edwido. Next, click 'Scanner' and choose 'Complete System Scan'. Remove all the bad entries ewido finds.
  
  2) Scan your PC with Panda Activescan and save the report.
  
  Post the Panda Activescan report with a new HJT log

  0
• blue472

  September 2005 edited September 2005

  Hello Trogan and once again thankyou,Did Scan with security suite and it deleted several viruses,Active scan did not show anything(couldn"t save report)here is new HJT log
  Logfile of HijackThis v1.99.1
  Scan saved at 9:55:21 AM, on 9/28/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
  C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\ewido\security suite\ewidoguard.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\unzipped\hijackthis[1]\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [sunasDTServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1118009368170
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
  O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
  O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
  O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
  O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
  O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
  O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
  O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

  0
• Trogan London, UK

  September 2005 edited September 2005

  Cool! Your log looks clean.
  
  You having any more problems?

  0
• blue472

  September 2005 edited September 2005

  Hi Trogan,I just did another scan w Panda and there are still several cookies,really baffled,any Alternate ideas,thanks for patience w this,Blue

  0
• Trogan London, UK

  September 2005 edited September 2005

  blue472 wrote:

  Hi Trogan,I just did another scan w Panda and there are still several cookies,really baffled,any Alternate ideas,thanks for patience w this,Blue

  Did you save a report of the panda scan? If not, no worries.
  
  The cookies are not harmful.
  
  If you havn't already got these then please download them.
  
  Ad-Aware SE 1.6 - finds and deletes cookies
  SypBot Search & Destroy 1.4
  SpywareBlaster 3.4
  
  Update them all and then run the scans with Ad-Aware and Spybot
  
  Post back if you have any real problems otherwise your computer is clean

  0
• blue472

  September 2005 edited September 2005

  Thankyou Trogan,I keep getting cookiies when scanning with panda but cccleaner seems to help.Thanks Tom

  0
• primesuspect Beepin n' Boopin Detroit, MI Icrontian

  September 2005 edited September 2005

  The cookies are always going to show up as part of your normal surfing activity. If you keep getting suspect cookies, you might want to re-evaluate your surfing habits. You can read this article to see what do avoid and maybe how you got infected in the first place.
  
  Is your problem solved?

  0