Options

Smitfraud Trojan

Unknown
edited July 2005 in Spyware & Virus Removal
I managed to get the Smitfraud Trojan which puts a window up on my desktop to try and get me to go to a web site.

here is my log:


Logfile of HijackThis v1.98.2
Scan saved at 12:51:05 PM, on 6/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\msole32.exe
C:\WINDOWS\System32\shnlog.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\intmon.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\WINDOWS\System32\updatelavasoft.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\hookdump.exe
C:\WINDOWS\System32\updatelavasoft.exe
C:\Program Files\America Online 9.0b\aoltray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\rwl\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oneclicksearches.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xkflp.dll/sp.html#69959
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Susan\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oneclicksearches.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hp4E56.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
O4 - HKLM\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
O4 - HKLM\..\RunServices: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\System32\hookdump.exe
O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:tsk.mht!http://69.50.166.110/5/s1//q.chm::/file.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll

Any help would be greatly appreciated!

Thanks!

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited June 2005
    You're loaded up pretty good with malware. Much more than just smitfraud.

    Please download Seeker's SpSeHjfix here:
    http://www.derbilk.de/SpSeHjfix112.zip
    Unzip it to the desktop but do NOT run it yet.

    Next, please reboot your computer in Safe Mode by doing the following:
    1) Restart your computer
    2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
    3) Instead of Windows loading as normal, a menu should appear
    4) Select the first option, to run Windows in Safe Mode.

    For additional help in booting into Safe Mode, see the following site:
    http://www.pchell.com/support/safemode.shtml


    Once in Safe Mode, please run SpSeHjfix.bat. Click "Start Disinfection" and follow the prompts. Allow your computer to reboot when required. Post the logfile from the tool here for me when done.




    You are using an outdated version of Hijackthis.
    Please download the current version of Hijackthis and post a new hijackthis log.

    http://www.short-media.com/download.php?d=245
  • rangerboy
    edited June 2005
    Byckey_Sam:

    I downloaded Seeker's SpSeHjfix and ran that. It sat there for quite some time and did not look like it was doing anything so I stopped it. But it was running and it created a log file:

    (6/18/05 7:57:17 PM) SPSeHjFix started v1.1.2
    (6/18/05 7:57:17 PM) OS: WinXP Service Pack 1 (5.1.2600)
    (6/18/05 7:57:17 PM) Language: english
    (6/18/05 7:57:17 PM) Win-Path: C:\WINDOWS
    (6/18/05 7:57:17 PM) System-Path: C:\WINDOWS\System32
    (6/18/05 7:57:17 PM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
    (6/18/05 7:57:50 PM) Disinfection started
    (6/18/05 7:57:50 PM) Bad-Dll(IEP): c:\docume~1\susan\locals~1\temp\se.dll
    (6/18/05 7:57:50 PM) UBF: 7 - UBB: 0 - UBR: 23
    (6/18/05 7:57:50 PM) UBF: 7 - UBB: 0 - UBR: 23
    (6/18/05 7:57:50 PM) Bad IE-pages:
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\susan\locals~1\temp\se.dll/spage.html
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page:
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch:
    (6/18/05 7:57:50 PM) Stealth-String not found
    (6/18/05 7:57:50 PM) No locked Files to delete. End without Reboot
    (6/18/05 7:58:33 PM) Disinfection started
    (6/18/05 7:58:33 PM) Bad-Dll(IEP): c:\windows\xkflp.dll
    (6/18/05 7:58:33 PM) UBF: 7 - UBB: 0 - UBR: 23
    (6/18/05 7:58:33 PM) UBF: 7 - UBB: 0 - UBR: 23
    (6/18/05 7:58:33 PM) Bad IE-pages:
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\xkflp.dll/sp.html#69959
    (6/18/05 7:58:33 PM) Stealth-String not found
    (6/18/05 7:58:33 PM) No locked Files to delete. End without Reboot


    I then ran it again with this log file:
    (6/18/05 8:06:25 PM) SPSeHjFix started v1.1.2
    (6/18/05 8:06:25 PM) OS: WinXP Service Pack 1 (5.1.2600)
    (6/18/05 8:06:25 PM) Language: english
    (6/18/05 8:06:25 PM) Win-Path: C:\WINDOWS
    (6/18/05 8:06:25 PM) System-Path: C:\WINDOWS\System32
    (6/18/05 8:06:25 PM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
    (6/18/05 8:06:29 PM) Disinfection started
    (6/18/05 8:06:29 PM) Bad-Dll(IEP): (not found)
    (6/18/05 8:06:29 PM) Bad-Dll(IEP) in BHO: (not found)
    (6/18/05 8:06:29 PM) UBF: 7 - UBB: 0 - UBR: 23
    (6/18/05 8:06:29 PM) UBF: 7 - UBB: 0 - UBR: 23
    (6/18/05 8:06:29 PM) Bad IE-pages: (none)
    (6/18/05 8:06:29 PM) Stealth-String not found
    (6/18/05 8:06:29 PM) Not infected->END


    I ran the updated Hijack with these results:

    Logfile of HijackThis v1.99.1
    Scan saved at 8:10:19 PM, on 6/18/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
    O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpB448.tmp
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
    O4 - HKLM\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
    O4 - HKLM\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
    O4 - HKLM\..\RunServices: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
    O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:tsk.mht!http://69.50.166.110/5/s1//q.chm::/file.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
    O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
    O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    I noticed that it still has an 04 runonce reference to spoolsrv32.exe. Should that be removed?

    thanks for your help
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited June 2005
    Next step...

    Please make sure that you can VIEW ALL HIDDEN FILES.

    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
    O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpB448.tmp
    O4 - HKLM\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
    O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
    O4 - HKLM\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
    O4 - HKLM\..\RunServices: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
    O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
    O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:tsk.mht!http://69.50.166.110/5/s1//q.chm::/file.exe
    O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
    O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
    O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll


    Reboot your computer into SAFE MODE

    Then delete these files or directories (Do not be concerned if they do not exist):

    c:\eied_s7.cab
    c:\ex.cab
    C:\wp.exe
    C:\wp.bmp
    C:\Windows\sites.ini
    C:\Windows\popuper.exe
    C:\WINDOWS\mmgsvc.exe
    C:\WINDOWS\System32\wldr.dll
    C:\Windows\System32\helper.exe
    C:\Windows\System32\intmon.exe
    C:\Windows\System32\intmonp.exe
    C:\Windows\System32\msmsgs.exe
    C:\Windows\System32\ole32vbs.exe
    C:\Windows\system32\msole32.exe
    C:\WINDOWS\system32\shnlog.exe
    C:\WINDOWS\system32\oleadm.dll
    C:\WINDOWS\System32\vbsys2.dll
    C:\WINDOWS\System32\spoolsrv32.exe
    C:\WINDOWS\System32\updatelavasoft.exe
    C:\WINDOWS\System32\hpB448.tmp
    C:\Windows\System32\Log Files
    C:\Program Files\Search Maid
    C:\Program Files\Virtual Maid
    C:\Program Files\Security IGuard



    Reboot your computer to go back to normal mode.



    Please run at least two of these online scans.
    Make sure they are set to clean automatically

    Panda Virus Scan

    Bit Defender

    TrendMicro Housecall

    There will be files that these scans will not remove. Please include that information in your next post.


    Reboot and post a new hijackthis log and the info from your virus scans.
  • rangerboy
    edited June 2005
    Buckeye_Sam

    I ran hijack and took care of the things you noted. One thing I notices was that the O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpB448.tmp
    you had listed came up as |hpF3D.tmp. I did not delete that one. Should I?

    The new log is as follows:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:59:06 AM, on 6/19/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Dell Support\DSAgnt.exe
    C:\WINDOWS\System32\hookdump.exe
    C:\Program Files\America Online 9.0b\aoltray.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\WINDOWS\system32\cidaemon.exe
    C:\Documents and Settings\Susan\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oneclicksearches.com/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oneclicksearches.com/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
    R3 - Default URLSearchHook is missing
    O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpF3D.tmp
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\System32\hookdump.exe
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
    O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
    O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
    O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    I seam to be having a problem with the O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe. Hijack does not seem to fix it. The Symantec web site said that for the Adware.Topantispyware threat, you need to remove the registry entries from HkeyLocal and Hkey_Current. I went into regedit and removed them. but I dont know if they came back yet.

    the following items on your list I deleted privously either manualy or with NAV:

    c:\eied_s7.cab
    C:\Windows\sites.ini
    C:\Windows\popuper.exe
    C:\Windows\System32\Log Files


    I deleted the follwing as per your instructions:

    C:\WINDOWS\mmgsvc.exe
    C:\Windows\System32\intmon.exe
    C:\Windows\System32\msmsgs.exe
    C:\WINDOWS\system32\shnlog.exe
    C:\WINDOWS\System32\vbsys2.dll
    C:\WINDOWS\System32\updatelavasoft.exe



    the following from your list I did not find:

    c:\ex.cab
    C:\wp.exe
    C:\wp.bmp
    C:\WINDOWS\System32\wldr.dll
    C:\Windows\System32\helper.exe
    C:\Windows\System32\intmonp.exe
    C:\Windows\System32\msmsgs.exe
    C:\WINDOWS\System32\hpB448.tmp

    I would think I wouild need to delete spoolsrv32.exe since the SYmantec info says it is a file loaded by the Adware but the system will not allow me to delete it.


    NAV 2005 keeps reporting Bloodhound.W32.EP in the file c:|Windows|System32|wininet.dll. It does not seem to be able to fix it nor can I deltete it or replace it.

    NAV also fouind the eiedS7C%#.exe dwonload virus which I have been able to remove.

    The systnme is still quite messed up. I have not yet been able to get on line to run the other onlive programs you suggested.

    ANy more suggestions from the above info?

    Thanks
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited June 2005
    Fix these lines with Hijackthis.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oneclicksearches.com/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oneclicksearches.com/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = http://localhost;
    R3 - Default URLSearchHook is missing
    O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpF3D.tmp
    O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
    O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\System32\hookdump.exe
    O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe




    The filename that shows up in 02 line will change frequently. It probably will not match exactly what is posted here from your log earlier today. But you need to delete whatever file is associated with that 02 line.


    Download the Pocket Killbox.

    Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.
    • Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:


        C:\WINDOWS\System32\spoolsrv32.exe
        C:\WINDOWS\System32\hookdump.exe
        C:\WINDOWS\System32\hpF3D.tmp <- change this to whatever shows up in your current log.

      [*]Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
      [*]Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

      Your system will reboot now.




      If you can, run the online virus scans and post a new hijackthis log. If you can't run the scans just post a new hijackthis log.
    • rangerboy
      edited June 2005
      Buckeye_Sam,

      thanks for the info, I am going to try and do all that now.

      quick question, is it ok to run Hijack and make the changes in safe mode, or does it have to be done in regular mode? Or is it preferable to do it in safe mode. Right now safe mode seems a lot more stable than regular, but I know that some things are limited in safe mode.

      thanks again.
    • rangerboy
      edited June 2005
      Buckeye_Sam,

      I ran Hijack in both safe mode and regualar mode and there was quite a difference it the logs. So I went with regular mode.

      I checked off all the items you listed and tried to fix them. It got rid of them all except for the RunOnce entries for spoolsrv32.exe. Multiple tries would not get rid of it.

      I then ran the Killbox. The .tmp file that I thought was the one on the log did not show up on the Killbox dropdown box. There was a hpBD4C.tmp file (it was the only one) in System32, and it was dated 6/17 which is when all this happend, so I put that one in the clipboard (hope that was the right thing to do). I had Killbow reboot the system.

      As it rebooted, it gave me a message that said Windows could not find spoolsrc32.exe and to check the path ect.

      It did reboot, but I still have the WARNING!! deskstop wallpaper thing (from Adware.Topanitspyware). The system seems a little more stable now, so I now attempting to run NAV 2005.

      Here is the Hijack log after the reboot:

      Logfile of HijackThis v1.99.1
      Scan saved at 10:59:10 PM, on 6/19/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
      C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
      C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
      C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
      C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\wuauclt.exe
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe
      C:\WINDOWS\system32\cidaemon.exe

      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (file missing)
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
      O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
      O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
      O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
      O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

      I have not tried to do an online scan yet, I want to see if NAV comes up with anything first.

      ANy other suggestions?

      Thanks


      additional info



      I was able to run NAV last night and it found i infection and 8 "at risk" items. it got rid of the following:

      2.dat
      ashlt.exe
      gdnUS1865.exe
      internt.exe
      newdevin.exe
      srocsrv32.dll
      txfdb32.dll

      it tried to repair, quaranteen, and delete wininet.dll, which it claims (with persistant warning windows) is infected with the bloodhound.W32.EP virus. I cant get rid of this at all. Attempts to find out about it give lots of confilcting information. Is it a virus or not? NAV says it is and it isnt. They also say that it does not affect XP. Do you know anything about this one?

      the system no longer puts up the Adware.Topantispyware desktop (I found a way to get rid of that in desktop properties) so that is a good thing.

      I still also have a problem with something starting up AOL. Nav report showed a program called msmsgs.exe attempting to connect to the internet. There is a folder in Program files with lots of files for this msmsgs.exe, the main folder is called "messanger". At one point you had told me to delete this out of system32, which I did, but it is still coming up. Is this a know spyware program or something legit?

      thanks for your help.
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      This is all part of Smitfraud. You seem to have a new variant.

      Run this online virus scan.

      Panda Virus Scan


      If for some reason you can not run the online scan then you can download and install a trial version of Panda antivirus. You will have to disable NAV before running Panda, but it should remove the virus and repair your wininet.dll file.

      http://www.pandasoftware.com/download/titanium-en/titanium-en.asp?track=18952


      Let me know how the scan goes and post a new hijackthis log when you are done.
    • rangerboy
      edited June 2005
      I submitted my infected wininet.dll file to Symantec for evaluation, they said it was infected with the W32.Desktophijack. They also *claim* that NAV will detect and repair the file. The told me to use the latest definitions. I went to the web site and looked it up, and it said it was discovered on 6/19/05 (which is when we got it) and updated on 6/20/5. I downloaded the lates def's (0620) and ran it. Nav found uninstlU.exe, oleadm.dll, and wininet.dll as infected. It was able to get rid of uninstlU.exe, but could not do anything with the ohters. The instructions suggested running NAV in safe mode, so I tried that and it still could not fix, quarinten, or delete the 2 dll files.

      I believe these files are used by IE. Does IE run in safe mode, and is that why they cant be fixed?

      I also notice something else. Please excuse my ignorance of XP, I am not that familiar with it. I ran Hijack again on the same user I had been logged in under for most of the time and got this log:

      Logfile of HijackThis v1.99.1
      Scan saved at 12:22:13 AM, on 6/21/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
      C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
      C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
      C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
      C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
      O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
      O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
      O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
      O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

      I then logged out, logged into another user (the one who was apparently running when the infection occured) and ran Hijack, and got this log:

      Logfile of HijackThis v1.99.1
      Scan saved at 12:16:27 AM, on 6/21/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
      C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
      C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
      C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
      C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oneclicksearches.com/bar.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oneclicksearches.com/search.php?qq=%1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
      R3 - Default URLSearchHook is missing
      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
      O4 - HKCU\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\System32\hookdump.exe
      O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
      O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
      O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
      O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
      O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

      As you can see they are quite different. I take it you have to run Hijack on each user? Do you also have to run NAV under each user?

      Which things should I remove on the second post above?

      I have just d/l the Panda software (here at work) and will try that tonight.

      Thanks for your help.

      Just thought of something else - since this is supposedly something new, I assume I will have to download new virus defintions for Panda?

      Thanks
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      Let's not start bouncing back and forth between two hijackthis logs. It's too confusing. Let's get the original one cleaned up and then it should be a snap to clean up the other user.

      You are putting too much faith in Norton. There are much better antivirus programs out there that will stop, detect, and remove malware better than NAV.

      Any antivirus program is only as good as it's last definitions. No matter what program you use you need to set it up to check daily for new virus definitions. As soon as you install Panda you will need to download and install all updates and defs for it before you run the scan.

      Once you run Panda post a new hijackthis log and let me know what Panda did for you.
    • rangerboy
      edited June 2005
      OK, I just typed a big post here and when I went to send it it told me I was not logged on, so here it is again in a nutshell:

      Uninstalled NAV.

      Installed Panda Titanium.

      Ran it and it found all kinds of stuff that it fixed. Some things it found were in a backup file on the desktop that I believe NAV put there.

      Took a chance and went on line to do the one free update for Panda. Ran it and if found and fixed lots more stuff. One was the oleadm.dll that I had not been able to get rid of before.

      Rebooted, logged on, and a program called PSGuard, a spyware detector, came up. Was suspisiuos of it, so checked on web, appartently this is part of the Smtfraud as well. Date and time on the Program File folder for this was when I was d/l the Panda update, so somehow this got through the Panda firewall and was not picked up at all by Panda AV.

      The is an entry for PSGuard on the Hijack log I posted below.

      Not sure if I mentioned it before but when I first started working on this machine it had a program that would start called Anti-VirusGold, which is apparent also related to Smitraud.

      Something is still causeing AOL to start up when you log on.

      Thanks for the help. We're getting closer but it is still pretty messed up.

      logs:

      Panda Titanium Antivirus 2005 incident report
      EVENT DATE RESULTS ADDITIONAL INFORMATION
      Scan completed 06/21/05 23:59:51 Scan: All My Computer
      Spyware detected: Cookie/MediaTickets 06/21/05 23:50:47 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc92.txt
      Spyware detected: Cookie/Kount 06/21/05 23:50:47 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc93.txt
      Spyware detected: Cookie/Hitbox 06/21/05 23:50:46 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc78.txt
      Spyware detected: Cookie/BurstNet 06/21/05 23:50:45 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc37.txt
      Spyware detected: Cookie/Ask 06/21/05 23:50:45 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc29.txt
      Spyware detected: Cookie/BurstBeacon 06/21/05 23:50:43 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc173.txt
      Spyware detected: Cookie/QuestionMarket 06/21/05 23:50:42 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc126.txt
      Spyware detected: Cookie/Overture 06/21/05 23:50:42 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc118.txt
      Dialer detected: Dialer.BEW 06/21/05 23:41:20 Eliminated Location: C:\Documents and Settings\Susan\Local Settings\Temp\komfmmgd.exe
      Dialer detected: Dialer.BEW 06/21/05 23:41:19 Eliminated Location: C:\Documents and Settings\Susan\Local Settings\Temp\egejnkgd.exe
      Adware detected: Adware/Hotoffers 06/21/05 23:41:15 Eliminated Location: C:\Documents and Settings\Susan\Desktop\backups\backup-20050619-223029-392.dll
      Dialer detected: Dialer.ABR 06/21/05 23:38:22 Eliminated Location: C:\Documents and Settings\Administrator\Desktop\backups\backup-20050619-100959-901.inf
      Adware detected: Adware/Hotoffers 06/21/05 23:37:42 Eliminated Location: c:\windows\system32\hhk.dll
      Scan started 06/21/05 23:36:40 Scan: All My Computer
      Scan completed 06/21/05 23:36:04 Scan: Pop-up menu
      Scan started 06/21/05 23:36:01 Scan: Pop-up menu
      Dialer detected: Dialer.BGS 06/21/05 23:28:51 Eliminated Location: c:\windows\system32\awm226.exe
      Spyware detected: Cookie/2o7.net 06/21/05 23:14:24 Eliminated Location: C:\Documents and Settings\Susan\Cookies\susan@2o7[1].txt
      Adware detected: Adware/Smitfraud 06/21/05 23:14:24 Eliminated Location: C:\WINDOWS\System32\oleadm.dll
      Adware detected: Adware/Popuper 06/21/05 23:14:12 Eliminated Location: Windows Registry
      Virus detected: Trj/Downloader.CFJ 06/21/05 23:14:06 Disinfected Location: C:\ms32.tmp
      Adware detected: Adware/Popup.pop 06/21/05 23:13:56 Eliminated Location: C:\WINDOWS\System32\WINSX.DLL
      Adware detected: Adware/PortalScan 06/21/05 23:13:00 Eliminated Location: C:\WINDOWS\mmgsvc.dat
      Adware detected: Adware/Smitfraud 06/21/05 23:11:49 Eliminated Location: C:\WINDOWS\System32\OLEADM.dll
      Update 06/21/05 23:10:51 OK New virus signatures: 6646
      Virus detected: Trojan Horse 06/21/05 22:59:44 Disinfected Location: c:\docume~1\susan\locals~1\temp\kfjh.bat
      Connection attempt 06/21/05 22:43:54 Blocked Source IP address: 205.188.146.145
      Connection attempt 06/21/05 22:43:01 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:58 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:58 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:51 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:48 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:41 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:38 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:30 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:24 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:21 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:11 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:11 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:11 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:08 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:05 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:05 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:05 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:05 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:02 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:02 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      Connection attempt 06/21/05 22:42:02 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:42:02 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:41:59 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:41:59 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:41:55 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:41:52 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:41:52 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:41:49 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:40:02 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Connection attempt 06/21/05 22:39:51 Blocked Application: C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WEBPROXY.EXE
      Scan completed 06/21/05 22:04:09 Scan: All My Computer
      Adware detected: Adware/PortalScan 06/21/05 22:01:50 Eliminated Location: C:\WINDOWS\SYSTEM32\winspoe.dll
      Adware detected: Adware/GloboSearch 06/21/05 22:01:32 Eliminated Location: C:\WINDOWS\SYSTEM32\systr.dll
      Virus detected: Trj/Downloader.BTV 06/21/05 21:55:48 Disinfected Location: C:\WINDOWS\Downloaded Program Files\tcekgmmb.exe
      Spyware detected: Cookie/Doubleclick 06/21/05 21:54:17 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc62.txt
      Spyware detected: Cookie/Centralmedia 06/21/05 21:54:15 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc43.txt
      Spyware detected: Cookie/CentrPort 06/21/05 21:54:15 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc44.txt
      Spyware detected: Cookie/Atlas DMT 06/21/05 21:54:13 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc30.txt
      Spyware detected: Cookie/Affiliate fuel 06/21/05 21:54:07 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc165.txt
      Spyware detected: Cookie/Mediaplex 06/21/05 21:54:04 Eliminated Location: C:\RECYCLER\S-1-5-21-2294958484-1687057853-389776565-1007\Dc104.txt
      Virus detected: Trj/Downloader.BTV 06/21/05 21:50:49 Disinfected Location: C:\Program Files\Internet Explorer\znefnprm.exe
      Virus detected: Trj/Downloader.BTV 06/21/05 21:50:48 Disinfected Location: C:\Program Files\Internet Explorer\tcekgmmb.exe
      Adware detected: Adware/Gigabar 06/21/05 21:48:26 Eliminated Location: C:\Program Files\America Online 9.0b\download\gigasoft.dll
      Adware detected: Adware/GloboSearch 06/21/05 21:48:26 Eliminated Location: C:\Program Files\America Online 9.0b\download\4.dat
      Adware detected: Adware/Findspy 06/21/05 21:45:09 Eliminated Location: C:\Documents and Settings\Susan\Local Settings\Temp\fckm.exe
      Spyware detected: Spyware/LocalNRD 06/21/05 21:44:34 Eliminated Location: C:\Documents and Settings\Justin\Local Settings\Temp\THI7FE4.tmp\localNrd.inf
      Adware detected: Adware/Findspy 06/21/05 21:44:32 Eliminated Location: C:\Documents and Settings\Justin\Local Settings\Temp\kflc.exe
      Adware detected: Adware/PurityScan 06/21/05 21:42:31 Eliminated Location: C:\Documents and Settings\Administrator\Desktop\backups\backup-20050619-100959-737.inf
      Virus detected: Trj/Downloader.WT 06/21/05 21:42:29 Disinfected Location: C:\Documents and Settings\Administrator\Desktop\backups\backup-20050619-100958-449.inf
      Adware detected: Adware/PowerStrip 06/21/05 21:42:20 Eliminated Location: C:\WINDOWS\mmgsvc?.bin
      Dialer detected: Dialer.XD 06/21/05 21:42:18 Eliminated Location: C:\WINDOWS\switchagreement.txt
      Spyware detected: Spyware/TVMedia 06/21/05 21:42:04 Eliminated Location: C:\Documents and Settings\Susan\Application Data\tvm*.dll
      Adware detected: Adware/PortalScan 06/21/05 21:41:54 Eliminated Location: Windows Registry
      Adware detected: Adware/eZula 06/21/05 21:41:44 Eliminated Location: C:\WINDOWS\System32\mscb.dll
      Scan started 06/21/05 21:41:16 Scan: All My Computer
      Scan completed 06/21/05 21:41:11 Scan: All hard disks
      Scan started 06/21/05 21:41:05 Scan: All hard disks
      Virus detected: Trj/Downloader.BTV 06/21/05 21:38:50 Disinfected Location: c:\windows\system32\cmd64.exe


      Logfile of HijackThis v1.99.1
      Scan saved at 12:09:30 AM, on 6/22/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AvltMain.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
      O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      Please remove these entries from Add/Remove Programs in the Control Panel(if present):

      PS Guard



      You see what I mean. Panda seemed to find a whole lot of things that Norton didn't even know was there.

      Double check and delete any of these files that remain on your computer.

      c:\windows\system32\hhk.dll
      c:\windows\system32\awm226.exe
      C:\WINDOWS\System32\oleadm.dll
      C:\ms32.tmp
      C:\WINDOWS\System32\WINSX.DLL
      C:\WINDOWS\mmgsvc.dat
      C:\WINDOWS\System32\OLEADM.dll
      C:\WINDOWS\SYSTEM32\winspoe.dll
      C:\WINDOWS\SYSTEM32\systr.dll
      C:\WINDOWS\Downloaded Program Files\tcekgmmb.exe
      C:\Program Files\Internet Explorer\znefnprm.exe
      C:\Program Files\Internet Explorer\tcekgmmb.exe
      C:\Program Files\America Online 9.0b\download\gigasoft.dll
      C:\Program Files\America Online 9.0b\download\4.dat
      C:\WINDOWS\mmgsvc?.bin
      C:\WINDOWS\switchagreement.txt
      C:\Documents and Settings\Susan\Application Data\tvm*.dll
      C:\WINDOWS\System32\mscb.dll
      c:\windows\system32\cmd64.exe



      ====================



      Delete temp files

      Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

      Navigate to the C:\Windows\Prefetch folder. Open the Prefetch folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Prefetch folder.

      Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

      Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

      Empty the Recycle Bin.



      =================



      Please follow these instructions to run Adware.
      • Download, install, update, configure, and run Ad-Aware SE Personal 1.06.
        1. Download Ad-Aware SE Personal 1.06:
        2. Install Ad-Aware SE Personal 1.06:
          • Double-click on aawsepersonal.exe to install the program.
          • Follow the default settings for installation.
          • After the program has finished installing uncheck the "Perform a full system scan now", "Update definition file now", and "Open the help file now" boxes.
        3. Update Ad-Aware SE Personal 1.06:
          • Double-click the Ad-Aware SE Personal icon on your desktop.
          • Click "Check for updates now" then click "Connect".
          • It will check for any updates. If any are found click "OK" to download and install the updates. Once it has finished click "Finish".
        4. Configure Ad-Aware SE Personal 1.06:
          • Click on the Gear button at the top of the window.
          • Click "General" on the left hand side to display the General Settings box.
            • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
              • "Automatically save logfile"
              • "Automatically quarantine objects prior to removal"
              • "Safe Mode (always request confirmation)"
              • "Prompt to update outdated definitions" - change to 7 days from the default 14.
          • Click "Scanning" on the left hand side to display the Scan Settings box.
            • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
              • "Scan within archives"
              • "Select drives & folders to scan" - select your hard drive(s).
              • "Scan active processes"
              • "Scan registry"
              • "Deep-scan registry"
              • "Scan my IE favorites for banned URLs"
              • "Scan my Hosts file"
          • Click "Advanced" on the left hand side to display the Advanced Settings box.
            • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
              • "Move deleted files to Recycle Bin"
              • "Include additional object information"
              • "Include negligible objects information"
              • "Include environment information"
          • Click "Defaults" on the left hand side to display the Default Settings box.
            • Make sure these items have your preferred settings in them.:
              • "Default homepage"
              • "Default searchpage"
          • Click "Tweak" on the left hand side to display the Tweak Settings box.
            • Click the + (plus) sign next to the Log Files section. This will expand the section.
            • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
              • "Include basic Ad-Aware settings in log file"
              • "Include additional Ad-Aware settings in log file"
              • "Include reference summary in log file"
              • "Include alternate data stream details in log file"
            • Click the + (plus) sign next to the Scanning Engine section. This will expand the section.
            • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
              • "Unload recognized processes & modules during scan"
              • "Scan registry for all users instead of current user only"
              • "Obtain command line of scanned processes"
            • Click the + (plus) sign next to the Cleaning Engine section. This will expand the section.
            • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
              • "Always try to unload modules before deletion"
              • "During removal, unload Explorer and IE if necessary"
              • "Let Windows remove files in use at next reboot"
              • "Delete quarantined objects after restoring"
          • Once you are done with these settings, click "Proceed" to save them.
          • This will take you back to the main screen.
        5. Run Ad-Aware SE Personal 1.05:
          • Click the "Start" button.
          • Uncheck the "Search for negligible risk entries" entry.
          • Choose the "Use custom scanning options" scan mode.
          • Click the "Next" button.
          • Ad-Aware will begin to scan for malware residing on your computer.
          • Allow the scan to finish.
          • Right-click on any entry in the list and click "Select All" to select the whole list.
          • Click "Next" and choose "OK" at the prompt to quarantine and remove the objects.

      Reboot and post a new hijackthis log. Let me know how things are running now.
    • rangerboy
      edited June 2005
      I removed PSGuard with add/remove.

      Ran Panda AV on all three accounts and it found the tvm*.dll in the Application Data of one of them. Panda seems to be happy now.

      I looked for the other files you had listed and did not find any of them.

      I deleted all the temp files and emptied the Recycle bins on all three accounts.

      I have d/l As-Aware 1.06 but ran out of time and could not run it last night. I will do that tonight and post logs.

      AOL still starts up whenever you log on to any of the accounts. I went into msconfig, and under the Startup tab, waol.exe and aoldial.exe are both there. Should they be, or did one of these Trojans set that up so that it could dial out right away?

      I have managed to restore the desktop of the one main account I have working with mainly, but the desktops of the other two accounts are still messed up, and the Display Properties window for the Desktop only has Theams and I think maybe the Screensaver tabs, the rest do not show up. At some point I will need to fix that too.

      Thanks again.
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      Your desktop problem is a symptom of Smitfraud.

      Download the following reg file to your desktop by right clicking on the link, and selecting save as.

      http://www.bleepingcomputer.com/files/reg/smitfraud.reg

      Once it has downloaded, double-click on the smitfraud.reg file on your desktop and when it asks if you would like to merge the data, click on the Yes button.

      Reboot your computer and you should now be able to change your desktop settings back to how you would like it. If your desktop still looks strange, go into your display properties and click on the Themes tab. Change the theme to Windows XP and you will now be using the default Windows XP settings. Then change them as you see fit.


      Post a new hijackthis log after the Adaware scan.
    • rangerboy
      edited June 2005
      OK, I downloaded the Smitfraud.rg and will run that tonight as well.

      Any ideas on the AOL auto startup problem in msconfig? Or do you think that is something that Ad-Aware and/or Hijack will uncover?

      Thanks again.
    • rangerboy
      edited June 2005
      I installed Ad-Aware 1.06 and got the updates. I ran it and it found 4 objects.
      I ran it on all the other accounts too (not sure it that was necessary) and it did not find anything else.

      I ran Hijack on the main account and got this log:

      Logfile of HijackThis v1.99.1
      Scan saved at 8:25:56 PM, on 6/23/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\system32\fxssvc.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



      This account seems to be working well now, for the most part.

      I have 2 problems, one old one new. AOL 9.0b still starts up when any account logs in. I cant find any reason for that, other than the fact that AOL shows up in the Start tab on msconfig. I don't think it should be there but I don't know that for sure. Any thought on that? It takes for ever for the log on to complete, not sure if that is only because of AOL starting or something else.

      The new problem is that with the Panda Titanium firewall running, I cant get on line with AOL. It dials up, talks to the network, and then stops and tells me it can't connect and one reason may be that the firewall is blocking it. If I turn the firewall off I can get online. I can't seem to find a way to manualy tell it to let AOL get on; Panda is set up to do everything automaticly. You can turn things on the list on and off, but I can't find a way to add something to the list. Any ideas?

      I ran the smitfraud.reg on the other two accounts, and that and a little digging got the desktop back to normal. I had to go into Desktop / Customize Desktop / Web, and delete the entry named "Security" before it would come back.

      I have hijacks on the other two accounts that I would like to post soon so I can fix them. I know one of them has oneclick entries in it.

      Thanks again for your help.
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      Your log is clean.

      There is certainly a setting within AOL that allows it to startup automatically on bootup. Or you can just fix these lines with Hijackthis.

      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe


      I would check with Panda support to work through firewall issue. I'm sure there's a way to get them to play together.

      For your other logs, now that the underlying infection is gone you should just be able to fix the R0/R1 lines with no problem. But feel free to post them if you want me to look them over.
    • rangerboy
      edited June 2005
      Buckeye_Sam,

      I would appreciate it if you would look at these other two hijack logs, just to make sure I dont miss anything.

      I'll try deleting those 2 lines for AOL. I checked all the settings for AOL when I run it, and none of the autostart settings are clicked on. I assume that since this did not start happening until after the virus problems, that one of those caused this.

      I have sent an emial to Panda, and also looked on there website. There was some information there that was a bit vague, but I'll give it a shot tonight.

      the 04 - HKLM .... Run entries, is that where XP knows what programs to run when you log in? So it is basicly the start up area?

      here are the two logs. The first one I know has problems since it has the oneclick stuff in it:


      First account:

      Logfile of HijackThis v1.99.1
      Scan saved at 9:51:11 PM, on 6/23/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\system32\fxssvc.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
      R3 - Default URLSearchHook is missing
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


      Second account:

      Logfile of HijackThis v1.99.1
      Scan saved at 9:06:16 PM, on 6/23/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\apvxdwin.exe
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\AOL Companion\companion.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
      O4 - HKCU\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



      Thanks again for all your help!
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      Like I said before, let's deal with one hijackthis log at a time. Just the first one for now.

      Fix these lines with hijackthis.

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
      R3 - Default URLSearchHook is missing
      O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe


      Reboot and post a new log.
    • rangerboy
      edited June 2005
      OK, I removed those entries, and here is the log:

      Logfile of HijackThis v1.99.1
      Scan saved at 9:06:16 PM, on 6/23/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\apvxdwin.exe
      C:\WINDOWS\System32\hkcmd.exe
      C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
      C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\Dell Support\DSAgnt.exe
      C:\Program Files\America Online 9.0b\aoltray.exe
      C:\Program Files\AOL Companion\companion.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Documents and Settings\Susan\Desktop\HijackThis.exe

      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
      O4 - HKLM\..\Run: [waol.exe] C:\Program Files\America Online 9.0b\waol.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
      O4 - HKCU\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
      O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\\aolserv.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
      O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
      O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
      O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
      O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
      O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
      O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
      O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


      I removed the two AOL entries and that took care of the start up problem.

      I still can not get the Panda Firewall to work with AOL (there email tech support was not very helpful) and I do not like the fact that it is pretty much so automatic. I turned it off and loaded Zone Alarm, which I am familiar with can got that working with their AOL account.


      Things seem to be stable, althought it still seems to run on the slow side.

      Do all those processes need to be running all the time?

      Thanks
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited June 2005
      You definitely need to fix these lines. They're malware.


      O4 - HKCU\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
      O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe



      These are optional fixes that will stop these programs from running at startup.

      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
      O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
      O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE



      Reboot and post another hijackthis log, if you have another one for me to look over.
    • rangerboy
      edited July 2005
      Buckeye;

      Everything seems to be stable now, althougth I can't get Panda's firewall to work with AOL. So far I am not impressed with their tech support. I turned off their firewall and installed ZoneAlarm, since I am familiar with it and it alows manual control.

      We purchased the real version of Panda Titanium 2005 AV, uninstalled the trial, installed the new one, and updated it. It started giving me pop up warnings that the file c:\windows\system32\wininet.dll was infected with Smitfraud, and that I had to reboot to complete the repair. No mater how many times I reboot this keeps coming up. Last night I ran it in safe mode, it said it found it, the log said it repaired it, but it also said I had to reboot, which, once again, did not fix it.

      So far my attempts to get tech support have not been answered.

      Any ideas? Could there be a problem with system restore on XP? Through all of this I have had that turned off and have not yet turned it back on.

      Thanks.
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited July 2005
      Download smitRem.zip and save the file to your desktop.
      Right click on the file and extract it to it's own folder on the desktop.


      Reboot your computer into SAFE MODE


      Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
      Wait for the tool to complete and disk cleanup to finish.

      The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log in your next reply.
    • rangerboy
      edited July 2005
      Buckeye;

      I ran smitRem this morning. It fouind the indected wininet.dll file and tried to replace it with a copy from elsewhere on the drive, but could not find one.

      I assume it was looking in the system restore files? System restore was turned off when we started trying to fix this machine.

      Here is the log:


      Pre-run Files Present


      ~~~ Program Files ~~~



      ~~~ Shortcuts ~~~



      ~~~ Favorites ~~~



      ~~~ system32 folder ~~~



      ~~~ Windows directory ~~~



      ~~~ Drive root ~~~

      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


      Post-run Files Present


      ~~~ Program Files ~~~



      ~~~ Shortcuts ~~~



      ~~~ Favorites ~~~



      ~~~ system32 folder ~~~



      ~~~ Windows directory ~~~



      ~~~ Drive root ~~~



      ~~~ Wininet.dll ~~~

      wininet.dll INFECTED!! Starting replacement procedure.

      ~~~ A good copy of wininet.dll was not found. Look for more locations. ~~~




      I assume I need to get a new copy of this dll. How do we do that? I have an XPHome machine as well but I don't know if the files would be the same.

      Thanks again.
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited July 2005
      Your best option, and the one that I recommend, is to just update Windows to SP2. That will restore a good wininet.dll file and you'll be good to go.
    • rangerboy
      edited July 2005
      Buckeye;

      I installed SP2 the other night and that took care of the .dll problem Panda kept reporting.

      Things seem to be working fine now, although the machine still runs very slowly. Actually, it seems to run even slower now with SP2.

      I'd like to find some ways to speed it up.

      Thanks for all your help!
    Sign In or Register to comment.