Victim - Spyware Strike

Comments

• Trogan London, UK

  January 2006 edited January 2006

  Hi, Welcome to Short-Media
  
  I have split your post, so you have your own thread and to avoid confusion
  
  
  Can you do the following:
  
  
  Go to Add/Remove programs in Control Panel and look for the following
  
  Media Gateway
  
  If found, please uninstall.
  ===
  
  
  Please read these instructions carefully and print them out! Be sure to follow ALL instructions!
  
  Download smitRem.exe and save the file to your desktop.
  Right click on the file and extract it to it's own folder on the desktop.
  
  If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
  Ad-Aware SE Setup
  Don't run it yet!
  
  Next, please reboot your computer in SafeMode by doing the following:

  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.

  Now scan with HJT and place a checkmark next to each of the following items and click 'Fix Checked':
  
  ===================================================
  O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpE3A9.tmp
  O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
  ===================================================
  
  Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
  Wait for the tool to complete and disk cleanup to finish.
  The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
  
  Open Ad-aware and do a full scan. Remove all it finds.
  
  Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.
  
  Reboot back into Windows
  Post a new HijackThis Log and the contents of the smitfiles.txt log.
  
  
  You are missing the top bit from HJT. Can you provide that info with your next post

  0
• victim

  January 2006 edited January 2006

  i'm having trouble rebooting in safe mode..i know how to do it and have done it before successfully but now it just won't happen!! once i press "safe mode" the screen fills up with commands (whatever they are!!)..

  0
• victim

  January 2006 edited January 2006

  could i just reboot in safe mode?

  0
• victim

  January 2006 edited January 2006

  ..sorry, in normal mode i meant...

  0
• Trogan London, UK

  January 2006 edited January 2006

  Try it in Normal Mode and see what happens.

  0
• victim

  January 2006 edited January 2006

  smitRem © log file
  version 2.8
  
  by noahdfear
  
  
  Microsoft Windows XP [Version 5.1.2600]
  The current date is: 27/01/2006
  The current time is: 1:24:06.50
  
  Running from
  C:\Documents and Settings\eirini.RENA-PC\Desktop\smit\smitRem
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  checking for ShudderLTD key
  
  ShudderLTD key not present!
  
  checking for PSGuard.com key
  
  
  PSGuard.com key not present!
  
  
  checking for WinHound.com key
  
  
  WinHound.com key not present!
  
  spyaxe uninstaller NOT present
  Winhound uninstaller NOT present
  SpywareStrike uninstaller NOT present
  
  Existing Pre-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  quick launch SpywareStrike 2.5.lnk
  SpywareStrike 2.5.lnk
  Online Security Guide.url
  Security Troubleshooting.url
  
  
  ~~~ Favorites ~~~
  
  Antivirus Test Online.url
  shopping
  
  
  ~~~ system32 folder ~~~
  
  replmap.dll
  1024 dir
  msvol.tlb
  ld****.tmp
  ncompat.tlb
  nvctrl.exe
  mscornet.exe
  hp***.tmp
  
  
  ~~~ Icons in System32 ~~~
  
  ot.ico
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  
  Starting registry repairs
  
  Registry repairs complete
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  SharedTask Export after registry fix
  
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  Deleting files
  
  
  Remaining Post-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  replmap.dll
  ld****.tmp
  ncompat.tlb
  nvctrl.exe
  mscornet.exe
  hp***.tmp
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~ Wininet.dll ~~~
  
  CLEAN!
  
  
  This is the top part of the previous HJT
  
  Logfile of HijackThis v1.99.1
  Scan saved at 01:20:16, on 27/01/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  
  ....need to send the final HJT....

  0
• victim

  January 2006 edited January 2006

  here you go mate...
  
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 01:39:05, on 27/01/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
  C:\Program Files\AVPersonal\AVWUPSRV.EXE
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\nvctrl.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\Program Files\AVPersonal\AVGNT.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\HJT\HijackThis.exe
  
  O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpF04B.tmp
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
  O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
  O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
  O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  0
• victim

  January 2006 edited January 2006

  my adawatch is going absolutely mental in the meantime..logging thousands of events!!!

  0
• victim

  January 2006 edited January 2006

  so what do you think doc? will it survive? the spyware strike icons have gone by the way...

  0
• Trogan London, UK

  January 2006 edited January 2006

  Hmm, thats strange. Its a good thing that you said Spyware Strike has gone but nothing has changed in your HJT log.
  
  Is this a new HJT log taken?

  0
• victim

  January 2006 edited January 2006

  yep

  0
• victim

  January 2006 edited January 2006

  should i try everything from the start?

  0
• Trogan London, UK

  January 2006 edited January 2006

  What you can do is try to go back into Safe Mode. If you can, then run SmitRem.
  
  If you can't, then let me know and we will continue

  0
• victim

  January 2006 edited January 2006

  man u really rock!!!!!!! thanks for taking the time to do this:) i'll be back...

  0
• victim

  January 2006 edited January 2006

  ..just won't start up in safe mode..do you think that the prob might be that my hard drive is partitioned into a windows part and a linux part. upon rebooting i get the choice to use either, if you get what i mean...if i choose windows and then press F8 the safe mode screen appears but then when i select it..blurb!!!

  0
• victim

  January 2006 edited January 2006

  ..should i try starting in safe mode and networking, or the other option that's available?

  0
• Trogan London, UK

  January 2006 edited January 2006

  Yeah, start in Safe Mode with Networking and run SmitRem.
  
  I would suggest diconnecting from the internet if you can.
  
  
  Post a new HJT log and the SmitRem file

  0
• victim

  January 2006 edited January 2006

  Logfile of HijackThis v1.99.1
  Scan saved at 02:30:18, on 27/01/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
  C:\Program Files\AVPersonal\AVWUPSRV.EXE
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\nvctrl.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\Program Files\AVPersonal\AVGNT.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\HJT\HijackThis.exe
  
  O2 - BHO: (no name) - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp8A6.tmp
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
  O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
  O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
  O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  
  
  
  
  
  
  smitRem © log file
  version 2.8
  
  by noahdfear
  
  
  Microsoft Windows XP [Version 5.1.2600]
  The current date is: 27/01/2006
  The current time is: 2:27:58.79
  
  Running from
  C:\Documents and Settings\eirini.RENA-PC\Desktop\smit\smitRem
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  checking for ShudderLTD key
  
  ShudderLTD key not present!
  
  checking for PSGuard.com key
  
  
  PSGuard.com key not present!
  
  
  checking for WinHound.com key
  
  
  WinHound.com key not present!
  
  spyaxe uninstaller NOT present
  Winhound uninstaller NOT present
  SpywareStrike uninstaller NOT present
  
  Existing Pre-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  replmap.dll
  1024 dir
  msvol.tlb
  ld****.tmp
  ncompat.tlb
  nvctrl.exe
  mscornet.exe
  hp***.tmp
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  
  Starting registry repairs
  
  Registry repairs complete
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  SharedTask Export after registry fix
  
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  Deleting files
  
  
  Remaining Post-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  ld****.tmp
  ncompat.tlb
  nvctrl.exe
  mscornet.exe
  hp***.tmp
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~ Wininet.dll ~~~
  
  CLEAN!
  
  .....................

  0
• victim

  January 2006 edited January 2006

  couldn't reboot in safe mode and networking either, just did it normally

  0
• Trogan London, UK

  January 2006 edited January 2006

  SmitRem doesn't seem to succeed in Normal Mode because the remains of Spyware Strike are still present. It looks like SmitRem needs to be run in Safe Mode for it to work properly.
  
  Start a thread in the Windows or Emergency forum and ask for help with your Safe Mode issue.
  
  Once that is sorted, then we can easily fix Spyware Strike.

  0
• victim

  January 2006 edited January 2006

  would you like to call it a day an we can maybe get back on it tomorrow?

  0
• Trogan London, UK

  January 2006 edited January 2006

  Thats cool.
  
  You can do it whenever you want
  
  Its late here anyway :O

  0
• victim

  January 2006 edited January 2006

  Hello again!
  I still haven't had word back 'bout the safe-mode start-up prob
  Was also wondering about the folding@home software. I'm using XP but don't know whether it's the graphical or text-only version; does it really matter which version i download?

  0
• Trogan London, UK

  January 2006 edited January 2006

  I saw Profdlp replied back to your Safe Mod thread.
  
  About F@H, it doesn't matter which you use. I use the text-only client.
  
  Thanks for joining

  0
• victim

  January 2006 edited January 2006

  Prodlp isn't replying and I'm getting really worried because I'm getting trojan alerts every so often. Is there anyone else you could recommend that might be able to help out, please?

  0
• Trogan London, UK

  January 2006 edited January 2006

  OK, can you post a new HJT log?
  
  What alerts are you getting?

  0
• victim

  January 2006 edited January 2006

  Hi again! Got safe-mode running properly and ran smit. This is the logfile:
  
  
  smitRem © log file
  version 2.8
  
  by noahdfear
  
  
  Microsoft Windows XP [Version 5.1.2600]
  The current date is: 28/01/2006
  The current time is: 19:03:57.00
  
  Running from
  C:\Documents and Settings\eirini.RENA-PC\Desktop\smit\smitRem
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  checking for ShudderLTD key
  
  ShudderLTD key not present!
  
  checking for PSGuard.com key
  
  
  PSGuard.com key not present!
  
  
  checking for WinHound.com key
  
  
  WinHound.com key not present!
  
  spyaxe uninstaller NOT present
  Winhound uninstaller NOT present
  SpywareStrike uninstaller NOT present
  
  Existing Pre-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  1024 dir
  msvol.tlb
  ld****.tmp
  ncompat.tlb
  nvctrl.exe
  mscornet.exe
  hp***.tmp
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  
  Starting registry repairs
  
  Registry repairs complete
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  SharedTask Export after registry fix
  
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  Deleting files
  
  
  Remaining Post-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~ Wininet.dll ~~~
  
  CLEAN!

  0
• Trogan London, UK

  January 2006 edited January 2006

  Cool. How did you get Safe Mode working?
  
  
  Could you post a new HJT log please. Then, I can tell whats left

  0
• victim

  January 2006 edited January 2006

  Just has do wait for ages to get the PC running after having rebooting in safe mode..I was too impatient and thought it hung !!:) My fault!
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 20:05:11, on 28/01/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
  C:\Program Files\AVPersonal\AVWUPSRV.EXE
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\Program Files\AVPersonal\AVGNT.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Windows Media Player\wmplayer.exe
  C:\HJT\HijackThis.exe
  
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
  O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
  O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
  O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\AdvTools\NPROTECT.EXE
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  0
• Trogan London, UK

  January 2006 edited January 2006

  Cool...SmitRem worked in Safe Mode. Spyware Strike is not showing in your log anymore.
  
  
  One last bit left to do
  
  Can you do the following:
  
  
  Please disable Ad-Watch, as it will interfere with the fix. You can re-enable it after your computer is clean.
  
  To disable Ad-Watch:
  
  1. Right click on the Ad-Watch icon in the system tray and select "Restore Ad-Watch".
  2. At the bottom of the screen there will be two checkable items called "Active" and "Automatic".

  Active: Switches Monitoring On or Off without closing Automatic: Switches Automatic Blocking On or Off

  3. Uncheck (red X) both items.
  =====
  
  
  Go to Add/Remove programs in Control Panel and look for the following
  
  Media Gateway
  
  If found, please uninstall.
  =====
  
  Open HijackThis
  - Click the Do a system scan only button
  - Check the following entries (below)
  
  O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
  
  - Close ALL open windows
  Click Fix Checked
  =====
  
  
  Find and Delete the followng:
  
  C:\Program Files\Media Gateway << this folder
  =====
  
  
  Reboot and post a new HJT log
  
  How are things?

  0