aright, i've gotten here and this teen ran into a stone wall

DistovolDistovol
edited June 2004 in Spyware & Virus Removal
argh on spyware, argh on it, how do I get rid of it plz?
grrrr.jpg


*please note* i also have this other stupid thing that I'm wondering if it's spyware or not, plz take a look
braw3.jpg
«1

Comments

  • Straight_ManStraight_Man Geeky, in my own way Naples, FL Icrontian
    edited June 2004
    Twunk is not BAD stuff, just a strange name for underlying parts of Windows that support scanning and digital cameras (only the latter to a dgree, scanners first and foremost).

    The WMP stuff I will leave to others, am not sure about the .PRX extension being used by Windows Media Player (looks like linguistic support or recorded files, on surface look in directory), I use other media software (surf and play CDs on my Linux box), and do not have German language WMP support stuff on my box as am using English-US language on that computer.

    Tell Ad-Watch to block the thing it is offering to block (block=prevent from happening, here, and abort means ABORT THE BLOCKING ACTION=DO NOT BLOCK) unless YOU set the home page to About_:Blank yourself in Internet Explorer, there are a bunch of IE hijack attempts that try to do this. Ad-Watch is trying to protect you, in this case, I would probably think this makes sense to block.

    I would run SyBot S&D 1.3, get the new defs for Adaware 6.0 build 181 for June of this year, and get HijackThis! 1.97.7 and run it and post a log. Also, please check your Antivirus software version and defs, get latest defs and possibly also latest version if you have softwaare that is voer two years old for Antivirus (reason for new software is updated and better heuristics, for defs is so software can specificly kill viruses by knowing them using def table). In Europe, BitDefender and F-Secure have best reputation for AV, and Kaspersky Labs and F-Prot are also good. I use F-Prot myself (on Windows) and Bitdefender (Linux box).
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    hijackthis and spybot S&D can be found via the link in my sig.
  • DistovolDistovol
    edited June 2004
    rgr, aright plz check this out... i dled s&d and removed some of this crap i've never heard of....
    hijack2.jpg
    hijack1.jpg
    that about blank still comes up
  • DistovolDistovol
    edited June 2004
    StartupList report, 6/19/2004, 11:04:43 AM
    StartupList version: 1.52
    Started from : C:\Documents and Settings\Shane\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.EXE
    Detected: Windows XP (WinNT 5.01.2600)
    Detected: Internet Explorer v6.00 (6.00.2600.0000)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\WINDOWS\System32\TASKMON.EXE
    E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    C:\WINDOWS\System32\rundll32.exe
    E:\Program Files\Adaware 6\Ad-aware 6\Ad-watch.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\svchost.exe
    e:\program files\MMJB.EXE
    e:\program files\MMDiag.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Shane\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    Listing of startup folders:

    Shell folders Common Startup:
    [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
    InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    SoundMan = SOUNDMAN.EXE
    InCD = E:\Program Files\ahead\InCD\InCD.exe
    ADUserMon = C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    Iomega Drive Icons = E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    Deskup = E:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
    Iomega Automatic Backup 1.0.1 = E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    POINTER = point32.exe
    VOBID = E:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
    IW ControlCenter = E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    PinnacleDriverCheck = C:\WINDOWS\System32\PSDrvCheck.exe
    ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    Task manager = TASKMON.EXE
    Winsock2 driver = WUAUMQR.EXE

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
    ATI Remote Control = E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    (Default) =
    SpySweeper = E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    Steam = D:\Program Files\Steam.exe -silent
    ssgrate.exe =

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

    Task manager = TASKMON.EXE

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=*INI section not found*
    SCRNSAVE.EXE=*INI section not found*
    drivers=*INI section not found*

    Shell & screensaver key from Registry:

    Shell=Explorer.exe
    SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
    drivers=*Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: Shell=*Registry key not found*
    HKLM\..\Policies: Shell=*Registry value not found*


    Enumerating Browser Helper Objects:

    (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    (no name) - E:\Program Files\Spybot Search and Destroy\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
    (no name) - C:\WINDOWS\System32\oehhba.dll - {8381EB02-0BEB-45A6-86C6-716D7B36E073}

    Enumerating Download Program Files:

    [Shockwave ActiveX Control]
    InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    [{33564D57-0000-0010-8000-00AA00389B71}]
    CODEBASE = http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    Enumerating ShellServiceObjectDelayLoad items:

    PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
    CDBurn: C:\WINDOWS\system32\SHELL32.dll
    WebCheck: C:\WINDOWS\System32\webcheck.dll
    SysTray: C:\WINDOWS\System32\stobject.dll
    End of report, 6,296 bytes
    Report generated in 0.297 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    Thanks. Instead of posting the pictures of the log, can you please click "save log" and then copy and paste the text in a reply. Looking up entries requires a lot of copy+paste, and that makes it much easier
  • DistovolDistovol
    edited June 2004
    k my bad man
    Logfile of HijackThis v1.97.7
    Scan saved at 11:13:00 AM, on 6/19/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\WINDOWS\System32\TASKMON.EXE
    E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    C:\WINDOWS\System32\rundll32.exe
    E:\Program Files\Adaware 6\Ad-aware 6\Ad-watch.exe
    C:\WINDOWS\System32\svchost.exe
    e:\program files\MMJB.EXE
    e:\program files\MMDiag.exe
    E:\Program Files\Spybot Search and Destroy\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Shane\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.counter-strike.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.counter-strike.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot Search and Destroy\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {8381EB02-0BEB-45A6-86C6-716D7B36E073} - C:\WINDOWS\System32\oehhba.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [InCD] E:\Program Files\ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    O4 - HKLM\..\Run: [Iomega Drive Icons] E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    O4 - HKLM\..\Run: [Deskup] E:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
    O4 - HKLM\..\Run: [Iomega Automatic Backup 1.0.1] E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [VOBID] E:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
    O4 - HKLM\..\Run: [IW ControlCenter] E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [Task manager] TASKMON.EXE
    O4 - HKLM\..\Run: [Winsock2 driver] WUAUMQR.EXE
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ATI Remote Control] E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    O4 - HKCU\..\Run: [SpySweeper] E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam.exe -silent
    O4 - HKCU\..\RunOnce: [Task manager] TASKMON.EXE
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited June 2004
    Distovol wrote:
    StartupList report, 6/19/2004, 11:04:43 AM
    StartupList version: 1.52

    ssgrate.exe =

    Uh-Oh

    Trojan.Mitglieder.B
  • DistovolDistovol
    edited June 2004
    hello? can anybody pelase help?
  • mmonninmmonnin Centreville, VA
    edited June 2004
    First move your HJT file into C:\HJT or C:\Program Files\HJT or something so that the backup files are not in your temp directory.

    Whats this file:

    C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html

    It doesnt look good to me. Anything in your temp directory can usually be deleted.

    Reboot into safemode and delete these:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about_:blank

    This one looks bad too:
    O2 - BHO: (no name) - {8381EB02-0BEB-45A6-86C6-716D7B36E073} - C:\WINDOWS\System32\oehhba.dll
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    This is a trojan as well:


    O4 - HKLM\..\Run: [Winsock2 driver] WUAUMQR.EXE

    run the free online norton scan located here:

    http://security.symantec.com/default.asp?productid=symhome&langid=ie&venid=sym
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited June 2004
    Distovol wrote:
    hello? can anybody pelase help?
    profdlp wrote:
    Uh-Oh

    Trojan.Mitglieder.B

    I found the "ssgrate.exe =" mentioned in several trojan descriptions.

    Try the link for removal instructions. :)
  • DistovolDistovol
    edited June 2004
    ive gotten rid of both of those, now how do I remove About:blank>
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    could you please post a new log :)
  • DistovolDistovol
    edited June 2004
    yes sir after I do all thse steps ill post a new thread thx
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    feel free to post in this one, it'll keep things neat and organized as well.
  • DistovolDistovol
    edited June 2004
    thanks moderator it worked :Rocker: :Rocker: :Rocker: :Rocker: :celebrate :celebrate :celebrate ;D;D :Rocker: :Rocker: :celebrate :ukflag: :Rocker: :celebrate :Canflag: !!!!!!!!!! geeze i love you but I dont know how to get rid of this value plz help
    showmod.jpg
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    When that pops up, click block. I'm having trouble understanding whether your problem is that this occurs frequently, or if you just don't know what to do when it pops up. Could you please clarify this for me.

    The most helpful thing right now would be a fresh HijackThis log so that we could see if we left anything behind.
  • DistovolDistovol
    edited June 2004
    Logfile of HijackThis v1.97.7
    Scan saved at 3:25:21 PM, on 6/19/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\WINDOWS\System32\TASKMON.EXE
    E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    C:\WINDOWS\System32\rundll32.exe
    E:\Program Files\Adaware 6\Ad-aware 6\Ad-watch.exe
    C:\WINDOWS\System32\svchost.exe
    D:\Program Files\Steam\Steam.exe
    e:\program files\MMJB.EXE
    e:\program files\MMDiag.exe
    e:\program files\MMDiag.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    E:\Program Files\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.counter-strike.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.counter-strike.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {8381EB02-0BEB-45A6-86C6-716D7B36E073} - C:\WINDOWS\System32\oehhba.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [InCD] E:\Program Files\ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    O4 - HKLM\..\Run: [Iomega Drive Icons] E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    O4 - HKLM\..\Run: [Deskup] E:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
    O4 - HKLM\..\Run: [Iomega Automatic Backup 1.0.1] E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [VOBID] E:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
    O4 - HKLM\..\Run: [IW ControlCenter] E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [Task manager] TASKMON.EXE
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ATI Remote Control] E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    O4 - HKCU\..\Run: [SpySweeper] E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam.exe -silent
    O4 - HKCU\..\Run: [Iomega Automatic Backup] E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    O4 - HKCU\..\RunOnce: [Task manager] TASKMON.EXE
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    thx
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    could you do a search of your computer for taskmon.exe, and post where it is located (c:\wherever)? I think it's probably a virus, depending on where it is located. Do you have an anti-virus program installed on your computer that you can run?
  • DistovolDistovol
    edited June 2004
    TASKMON.EXE-37B365F2.pf
    C Windows Prefetch

    is there a problem with that dude? :rant:
    hopefuly it's not bad...and also can you help me with this plz, whenever I go to a site like www.blahbalbahhblah.com (not an actual site) it automatically redirects me to a spyware site here is the link of that http://s1di.ewizard.cc/index.php?aid=20038 (beware, pop-ups) can you help me get rid of that too?
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    I can try to help :)

    Boot into safe mode (to make sure that everything is removed completely), and remove these entries w/ hijackthis:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.counter-strike.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.counter-strike.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shane\LOCALS~1\Temp\sp.html
    O2 - BHO: (no name) - {8381EB02-0BEB-45A6-86C6-716D7B36E073} - C:\WINDOWS\System32\oehhba.dll (file missing)
    O4 - HKLM\..\Run: [Task manager] TASKMON.EXE
    O4 - HKCU\..\RunOnce: [Task manager] TASKMON.EXE

    next, delete the file c:\windows\system32\TASKMON.EXE

    next, run cwshredder, available from the link in my sig.

    finally, repost another log when you've done all that good stuff :)
  • DistovolDistovol
    edited June 2004
    k thx man this is what happened when i removed those and used shredder

    Done!
    Removed from your system:
    - CWS.Searchx
    - 1 infected IE registry values

    Windows XP (5.01.2600 )
    CWShredder v1.59.0
    Written by Merijn - merijn@spywareinfo.com

    For any additional help with this program or removing CWS, visit:
    http://forums.spywareinfo.com/

    For information and documentation on the Coolwebsearch
    trojan and its variants, visit:
    http://www.spywareinfo.com/~merijn/cwschronicles.html

    For donations to help support CWShredder, visit:
    http://www.spywareinfo.com/~merijn/donate.html

    then i did this clan log thing you told me with hijackthis
    Logfile of HijackThis v1.97.7
    Scan saved at 4:16:32 PM, on 6/19/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    E:\Program Files\HJT\HijackThis.exe

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [InCD] E:\Program Files\ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
    O4 - HKLM\..\Run: [Iomega Drive Icons] E:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    O4 - HKLM\..\Run: [Deskup] E:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
    O4 - HKLM\..\Run: [Iomega Automatic Backup 1.0.1] E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [VOBID] E:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
    O4 - HKLM\..\Run: [IW ControlCenter] E:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [Task manager] TASKMON.EXE
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ATI Remote Control] E:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
    O4 - HKCU\..\Run: [SpySweeper] E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam.exe -silent
    O4 - HKCU\..\Run: [Iomega Automatic Backup] E:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
    O4 - HKCU\..\RunOnce: [Task manager] TASKMON.EXE
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    *PS Edit, i did what u said and it gives me that stupid spyware site when i got to a site that doesnt exist www.asdfasdfasdf.com it goes to a stupid spyware site...plz help
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    ok...it seems that you were not rid of taskmon.exe. did you remove the entries that were in the hijackthis log, and then delete the file manually? I just want to make sure while I look for an online trojan scan for ya.
  • DistovolDistovol
    edited June 2004
    shwaip wrote:
    ok...it seems that you were not rid of taskmon.exe. did you remove the entries that were in the hijackthis log, and then delete the file manually? I just want to make sure while I look for an online trojan scan for ya.
    ya i did it's all gone i checked HJ log (new) and it was there but I removed it :) and I removed it normally too
    ARGH but i still get that stupid http://s1di.ewizard.cc/index.php?aid=20038 site whenever I go to a random ws that doesn exist plz help me shwai thx
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    The problems are most likely related. Lemme see what I can find.
  • DistovolDistovol
    edited June 2004
    k man ill be waiting thanks very much for taking me this far
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    Bazooka anti-spyware is supposed to fix this. You could give it a try:

    http://www.bysoft.se/sureshot/kephyrdl/bazookasetup.exe
  • DistovolDistovol
    edited June 2004
    shwaip wrote:
    Bazooka anti-spyware is supposed to fix this. You could give it a try:

    http://www.bysoft.se/sureshot/kephyrdl/bazookasetup.exe
    stay takes me http://s1di.ewizard.cc/index.php?aid=20038 man it pisses me off...plz help?
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    I've posted in the staff forum for the other spyware experts to come help. I'm kinda at a dead end, but I'll make sure we get this fixed.
  • DistovolDistovol
    edited June 2004
    thx man I hope someboy can help, this is really really annoying me thx, I'll check back regularly for updates :banghead:
Sign In or Register to comment.