possible spyware

Unknown

i have a computer that im sure is infected with spyware and other dodgy stuff.

im not sure about 2 processes

winlogd.exe and ctfnom.exe. im pretty sure they arent ligit services but if someone can have a look at my hijackthis log.

many thanks

Logfile of HijackThis v1.98.2
Scan saved at 20:02:36, on 01/11/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\srv32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\windll.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
G:\tools\startup tools\standalone Startup.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
G:\tools\antispyware\hijackthis\HijackThis.exe
C:\WINDOWS\System32\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.tiscali.co.uk/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Dll Management] windll.exe
O4 - HKLM\..\RunServices: [Microsoft Dll Management] windll.exe
O4 - HKLM\..\RunServices: [Windows logging] winlogd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [tkonnect] C:\Program Files\Tiscali\tkonnect\tkonnect.exe updatemode
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .MPG: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=1bc2dfe0cd56b08e83cbcd56822b9d185e66a8f156560ebb18ffa2c9543cc6154a3682076ebe09604513aa4789bd8e86d2adc8ed06413126da65b131d9d0c31979:1c94cf8dd60a92140234c44bda683591

Crunchie

Open Task Manager & end process on the following:
srv32.exe
windll.exe

Then go to C:\WINDOWS\System32 and delete those manually.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and tell HijackThis to "Fix checked."

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [Microsoft Dll Management] windll.exe
O4 - HKLM\..\RunServices: [Microsoft Dll Management] windll.exe
O4 - HKLM\..\RunServices: [Windows logging] winlogd.exe

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...234c44bda683591

Search for the winlogd.exe file and delete it if found.

Reboot after doing the above, scan with hijackthis, then post that log here please.

dutch6

many thanks for the quick reply. i will delete the entries you state.

one thing though that is not listed in the hijackthis log file

is ctfnom.exe a ligitamate process? it is lurking around the system somewhere and i cant find any info on the net, which probably means thats its dodgy. but do you know what it is?

cheers

Trogan

dutch6 wrote:

many thanks for the quick reply. i will delete the entries you state.

one thing though that is not listed in the hijackthis log file

is ctfnom.exe a ligitamate process? it is lurking around the system somewhere and i cant find any info on the net, which probably means thats its dodgy. but do you know what it is?

cheers

The reason you cannot find info about it is because your spelling it wrong (its Ctfmon.exe not Ctfnom.exe) and besides its LEGIT.

So you beileve me read THIS LINK

dutch6

its not a spelling mistake

the process is called ctfnom.exe.

ctfmon.exe is a windows monitoring process and you are right, it is ligit and is running on the pc with ctfnom.exe running listed underneath it in task manager.

im convinced its dodgy and is connected with the problems listed above eg windll.exe etc. just trying to make sure.

thanks anyway

Trogan

Yeah seems I was wrong and your right, sorry. There is a thing called Ctfnom.exe and I've been searching to see what it is and according to someone elses HJT in another forum, they also have ctfnom.exe and its suppose to be a Win Updator Service.

Heres the line from the persons HJT.
O4 - HKLM\..\Run: [Win Updator Services] ctfnom.exe

It could be legit??

dutch6

yes thats right, rings a bell now.

Your also right that it could be legit. But if it is legit why is there no info on the web? Theres usually something somewhere with legit services and processes.

Might leave it for time being, sort the other stuff, then see how it goes.

cheers

Trogan

Post a new log for someone to look at but do what Juslooking said. I aint an expert at HJT logs

SpywareShooter

ctfnom is not legit. ctfmon is. Fix the entry with ctfnom in it and then delete teh file.

dutch6

thanks for that. I will get rid of cftnom.exe as well

thanks for help from everyone

Crunchie

If you are not certain of a particular file, upload it here;

http://www.kaspersky.com/remoteviruschk.html