Options

Smitfraud.c - please I need help !

Unknown
edited April 2005 in Spyware & Virus Removal
Helo
In the last few days I see tons of pupup adds on my comp and on my screen i get a dumd backround the says something about an error and I scand my comp with AVG, Norton and Microsoft antuspyware and all of them gave me nothing !
this is my HiJackThis log:


Logfile of HijackThis v1.99.1
Scan saved at 11:50:23, on 21/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Program Files\Microsoft AntiSpyware\gcasServ.exe
E:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
E:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
E:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\popuper.exe
C:\WINDOWS\system32\intmonp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.il
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nana.co.il/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.il
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.nana.co.il
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [%FP%012-L2TP fts.exe] "C:\Program Files\012Net\012Net-Cable dialer\fts.exe"
O4 - HKLM\..\Run: [%FP%012-L2TP FWPortal.exe] "C:\Program Files\012Net\012Net-Cable dialer\FWPortal.exe" -no_dialog
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NAV Agent] E:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {A5A10FE7-9D1D-4568-B719-E846E77068FF} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A5A10FE7-9D1D-4568-B719-E846E77068FF} - (no file) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113500466252
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1318DF9-BF54-4C38-B931-0496F207F81C}: NameServer = 212.117.129.5 212.116.161.37
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

can anyone help me and dont know what to do !

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Please do a search for this file on your computer and let me know of every location that you find it.

    msmsgs.exe
  • pumba17
    edited April 2005
    C:\Program Files\messenger

    C:\WINDOWS\Prefetch

    C:\WINDOWS\SoftwareDistribution\Download\135ea432d04970347d45dbf4554dc4d1

    C:\WINDOWS\SoftwareDistribution\Download\19be8718b1e4d344d81159836e024baf\sp2gdr

    C:\WINDOWS\SoftwareDistribution\Download\19be8718b1e4d344d81159836e024baf\sp2qfe

    C:\WINDOWS\ServicePackFiles\i386


    this is all the search found.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    OK, good. It's possible that your messenger file has been infected. Do you use Messenger frequently?

    Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
    O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe



    Reboot your computer into Safe Mode

    Then delete these files or directories (Do not be concerned if they do not exist):

    c:\wp.exe


    Reboot your computer to go back to normal mode and post a new log.
  • pumba17
    edited April 2005
    well I did what you told me but I did not find that file on safe mode (I did the rest)
    and this is my new log:





    Logfile of HijackThis v1.99.1
    Scan saved at 14:42:59, on 23/04/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\popuper.exe
    C:\Program Files\012Net\012Net-Cable dialer\fts.exe
    C:\Program Files\012Net\012Net-Cable dialer\FWPortal.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\intmonp.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    E:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    E:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    E:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    E:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.il
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nana.co.il/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.il
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.nana.co.il
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [%FP%012-L2TP fts.exe] "C:\Program Files\012Net\012Net-Cable dialer\fts.exe"
    O4 - HKLM\..\Run: [%FP%012-L2TP FWPortal.exe] "C:\Program Files\012Net\012Net-Cable dialer\FWPortal.exe" -no_dialog
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [NAV Agent] E:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {A5A10FE7-9D1D-4568-B719-E846E77068FF} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A5A10FE7-9D1D-4568-B719-E846E77068FF} - (no file) (HKCU)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113500466252
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C1318DF9-BF54-4C38-B931-0496F207F81C}: NameServer = 212.117.129.5 212.116.161.37
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


    by the way my screen is now black and it says nothing but I still cant change it.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Try this:
    • Click Start>Control Panel>Display
    • Go to the Desktop tab and click on the Customise Desktop button.
    • Go to the Web tab
    • In the web page box, click on the page that is checkmarked and then click the Delete button.
    • Ok your way out of the dialog and check your desktop.


    Are you still getting popups? How is everything running?
  • pumba17
    edited April 2005
    steel have pupups it didn't work...
    and my screen is still black.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Download rkfiles.zip
    http://skads.org/special/rkfiles.zip
    Unzip the contents to a permanent folder.

    Reboot your computer into Safe Mode


    Doubleclick rkfiles.bat
    It will scan for a while, so please be patient.
    Wait till the DOS window closes and reboot back to normal mode.

    Post the contents of C:\log.txt in your next reply.
  • pumba17
    edited April 2005
    this is what it gave me


    C:\rkfiles

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Files Found in system Folder............
    C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
    C:\WINDOWS\system32\DivX.dll: PEC2
    C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
    C:\WINDOWS\system32\DivX.dll: PEC2

    Files Found in all users startup Folder............
    Files Found in all users windows Folder............
    C:\WINDOWS\popuper.exe: FSG!
    Finished
    bye
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Please run at least two of these online scans.
    Make sure they are set to clean automatically:

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    http://www.bitdefender.com/scan/licence.php

    http://housecall.trendmicro.com/housecall/start_corp.asp

    There will likely be files that these scans will not remove. You will be given an option at the end of the scan to view a log that will include a list of these files. Please include that information in your next post.


    Delete these two files, if present:

    C:\WINDOWS\popuper.exe
    C:\WINDOWS\system32\DivX.dll


    Reboot and post a new hijackthis log.
  • pumba17
    edited April 2005
    this is what the panda scan gave me:


    Incident Status Location

    Adware:Adware/Puper No disinfected C:\WINDOWS\popuper.exe
    Adware:Adware/Puper No disinfected C:\WINDOWS\system32\intmonp.exe
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Ori\Favorites\Online Gambling\Online Gambling.url
    Adware:Adware/Startpage.LH No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Online Pharmacy.url
    Adware:Adware/SuperSpider No disinfected C:\Documents and Settings\Ori\Favorites\online dating.url
    Adware:Adware/BlueScreenWarningNo disinfected Windows Registry
    Adware:Adware/SuperSpider No disinfected C:\Documents and Settings\Ori\Favorites\Online Dating.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Ori\Favorites\Online Gambling\Online Gambling.url
    Adware:Adware/Startpage.LH No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Hydrocodone.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Lortab.url
    Adware:Adware/Startpage.LH No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Online Pharmacy.url
    Adware:Adware/Startpage.LH No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Prozac.url
    Adware:Adware/Startpage.LH No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Valium.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Ori\Favorites\Online Pharmacy\Vicodin.url
    Adware:Adware/Puper No disinfected C:\WINDOWS\popuper.exe
    Adware:Adware/Puper No disinfected C:\WINDOWS\system32\intmonp.exe
    Spyware:Spyware/Altnet No disinfected E:\Program Files\Altnet\Download Manager\asm.exe
    Spyware:Spyware/Altnet No disinfected E:\Program Files\Altnet\Download Manager\asmps.dll
    Spyware:Spyware/New.net No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\CommonName.zip[kazaa_336.exe]
    Adware:Adware/SaveNow No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\CommonName.zip[SaveNowInst.exe]
    Adware:Adware/DownloadWare No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\CommonName.zip[WebInstall.exe]
    Adware:Adware/DownloadWare No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\CommonName1.zip[WebInstall.exe]
    Adware:Adware/DownloadWare No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\CommonName2.zip[WebInstall.exe]
    Adware:Adware/DownloadWare No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\CommonName3.zip[WebInstall.exe]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator10.zip[GMT.exe]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator11.zip[GMT.exe]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator2.zip[GMT.exe]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator5.zip[CMEUpd.exe]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator5.zip[GIocl.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator5.zip[GIoclClient.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator5.zip[GStore.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator5.zip[GStoreServer.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator7.zip[GMT.exe]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator8.zip[GIocl.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator8.zip[GIoclClient.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator8.zip[GStore.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator8.zip[GStoreServer.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator9.zip[GIocl.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator9.zip[GIoclClient.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator9.zip[GStore.dll]
    Adware:Adware/Gator No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Gator9.zip[GStoreServer.dll]
    Spyware:Spyware/New.net No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Newnet14.zip[newdotnet3_36.dll]
    Spyware:Spyware/New.net No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\Newnet6.zip[newdotnet3_36.dll]
    Adware:Adware/DelFinMedia No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\PromulGate1.zip[PgMonitr.exe]
    Adware:Adware/DelFinMedia No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\PromulGate2.zip[PgMonitr.exe]
    Adware:Adware/DelFinMedia No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\PromulGate3.zip[PgMonitr.exe]
    Adware:Adware/SaveNow No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\SaveNow2.zip[SaveNow.exe]
    Adware:Adware/SaveNow No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\SaveNow2.zip[Uninst.exe]
    Adware:Adware/SaveNow No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\SaveNow5.zip[SaveNow.exe]
    Adware:Adware/SaveNow No disinfected E:\Spybot - Search & Destroy 1.1\Recovery\SaveNow6.zip[SaveNow.exe]


    and after the panda scan I erased what you told me to rebooted and here is the scan:



    Logfile of HijackThis v1.99.1
    Scan saved at 18:35:02, on 27/04/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\012Net\012Net-Cable dialer\fts.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    E:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    E:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    E:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\wuauclt.exe
    D:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.il
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nana.co.il/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.il
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.nana.co.il
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [%FP%012-L2TP fts.exe] "C:\Program Files\012Net\012Net-Cable dialer\fts.exe"
    O4 - HKLM\..\Run: [%FP%012-L2TP FWPortal.exe] "C:\Program Files\012Net\012Net-Cable dialer\FWPortal.exe" -no_dialog
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [NAV Agent] E:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {A5A10FE7-9D1D-4568-B719-E846E77068FF} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A5A10FE7-9D1D-4568-B719-E846E77068FF} - (no file) (HKCU)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113500466252
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


    and I still cant change the wallpaper...
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Right click on http://www.greyknight17.com/spy/RepairDesktop.reg and download that file. Double click on it and click on Yes when it asks you if you want to merge it into the registry. Once that's done, restart your computer.
Sign In or Register to comment.