Java / Byte Verify

Unknown
edited July 2005 in Spyware & Virus Removal
Good afternoon all,

I came home from work last night to be told by my son that the pc had picked up a virus while trawling the internet. With my limited knowledge I was able to identify 1 instance of trojan horse and 4 instances of java byte. AVG was able to remove trojan but I'm stuck with java byte.

The symptoms are that I get a "windows explorer problem" dialogue every few seconds and when I acknowledge this my desktop resets.

I have run Spybot and Ad-aware but still have the problem so I downloaded HiJack This and provide the log file created.

I'm running XP Home and Netscape 7.2.

Logfile of HijackThis v1.99.1
Scan saved at 12:13:43, on 02/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\r_server.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\htpatch.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\Common Files\LapLink\Scheduler\llsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\LapLink\SCHEDU~1\LLSchEng.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mainconcept\PVR\PvrLauncher.exe
C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\hiJackThis\HijackThis.exe
C:\WINDOWS\explorer.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://memberservices.passport.net/ppsecure/MSRV_ResetPW.srf?lc=1033
R3 - URLSearchHook: (no name) - {6BAC7C77-7525-2F88-DF1A-D7D75B7FF060} - NopeZ.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-716D61783548} - C:\WINDOWS\System32\max3548.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [LapLink Scheduler] C:\Program Files\Common Files\LapLink\Scheduler\llsched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [systemdll] wormexe.exe
O4 - HKLM\..\Run: [iehelper] NsCplTray.exe
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [WhatsNewBot] 34763.exe
O4 - HKCU\..\Run: [porka_] SysSupport.exe
O4 - HKCU\..\Run: [AppMasterCenter] NSYSCPLSTR.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: PVR Launcher.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {004DF9D9-566D-11D7-B77D-00E018901A05} - http://195.197.231.3/iqeye.ocx
O16 - DPF: {304171C0-65EA-4B51-B5D9-93A311E26EB1} - http://219.101.248.138:8106/cgi-bin/MxPEG_ActiveX.cab?dummy=3355759
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://clearly.axiscam.net:263/activex/AMC.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://procam3.proserve.nl/activex/AxisCamControl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CF38E898-0A6B-11D6-83C6-0080AD7D6076} (NPRemvuPluginControl) - http://192.168.125.95/webpages/NPRemvu.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://axis.axiscam.net/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{16B778A2-9BAF-43D3-8B65-B3FBC0B9C2A9}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{5586C11E-050F-4483-963F-D634BC1BCF5A}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB5D945A-E543-43C5-93F8-E747D4E6F1BC}: NameServer = 69.50.176.196,195.225.176.110
O20 - Winlogon Notify: style2 - C:\WINDOWS\q1175171_disk.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\System32\r_server.exe" /service (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

Thank you kindly in anticipation of your help in this matter.

Alan

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Are you aware that you have VNC(Virtual Network) installed on your computer? It's not malware in itself, but it does allow remote access and I've found instances where people did not know that someone could control their computer from somewhere else. As long as you know about it, it's ok.


    You do have some issues showing up in your log.



    Please run at least two of these online scans.
    Make sure they are set to clean automatically

    Panda Virus Scan

    Bit Defender

    TrendMicro Housecall

    There will be files that these scans will not remove. Please include that information in your next post.


    Reboot and post a new hijackthis log and the info from your virus scans.
  • AlanC
    edited July 2005
    Hi again, finally finished running Bit Defender and Panda. Panda took hours, hence the delay in getting back.

    Yes, I was aware of VNC, thanks anyway.

    The latest hijack log (after reboot) is as follows:

    Logfile of HijackThis v1.99.1
    Scan saved at 19:46:12, on 02/07/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\htpatch.exe
    C:\Apps\ActivBoard\MMKeybd.exe
    C:\Apps\ActivBoard\TrayMon.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Apps\ActivBoard\OSD.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
    C:\Apps\ActivBoard\nhksrv.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Common Files\LapLink\Scheduler\llsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\COMMON~1\LapLink\SCHEDU~1\LLSchEng.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\Program Files\Mainconcept\PVR\PvrLauncher.exe
    C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
    C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\r_server.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\hiJackThis\HijackThis.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\System32\dwwin.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://memberservices.passport.net/ppsecure/MSRV_ResetPW.srf?lc=1033
    R3 - URLSearchHook: (no name) - {6BAC7C77-7525-2F88-DF1A-D7D75B7FF060} - NopeZ.dll (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-716D61783548} - C:\WINDOWS\System32\max3548.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
    O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
    O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
    O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [LapLink Scheduler] C:\Program Files\Common Files\LapLink\Scheduler\llsched.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [systemdll] wormexe.exe
    O4 - HKLM\..\Run: [iehelper] NsCplTray.exe
    O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
    O4 - HKCU\..\Run: [WhatsNewBot] 34763.exe
    O4 - HKCU\..\Run: [porka_] SysSupport.exe
    O4 - HKCU\..\Run: [AppMasterCenter] NSYSCPLSTR.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: PVR Launcher.lnk = ?
    O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
    O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
    O16 - DPF: {004DF9D9-566D-11D7-B77D-00E018901A05} - http://195.197.231.3/iqeye.ocx
    O16 - DPF: {304171C0-65EA-4B51-B5D9-93A311E26EB1} - http://219.101.248.138:8106/cgi-bin/MxPEG_ActiveX.cab?dummy=3355759
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://clearly.axiscam.net:263/activex/AMC.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://procam3.proserve.nl/activex/AxisCamControl.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CF38E898-0A6B-11D6-83C6-0080AD7D6076} (NPRemvuPluginControl) - http://192.168.125.95/webpages/NPRemvu.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://axis.axiscam.net/activex/AMC.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{16B778A2-9BAF-43D3-8B65-B3FBC0B9C2A9}: NameServer = 69.50.176.196,195.225.176.110
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5586C11E-050F-4483-963F-D634BC1BCF5A}: NameServer = 69.50.176.196,195.225.176.110
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CB5D945A-E543-43C5-93F8-E747D4E6F1BC}: NameServer = 69.50.176.196,195.225.176.110
    O20 - Winlogon Notify: style2 - C:\WINDOWS\q1175171_disk.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\System32\r_server.exe" /service (file missing)
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)


    BitDefender Log:

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\exploit[1].exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\exploit[1].exe


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\index[1].chm


    Infected with: Trojan.Downloader.Vbs.Psyme.AC

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\index[1].chm


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\index[1].chm


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/exec.htm


    Infected with: Exploit.Html.Codebase.Exec.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/exec.htm


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/exec.htm


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm


    Update failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/x.htm


    Infected with: Exploit.Html.Codebase.Exec.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/x.htm


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/x.htm


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm


    Update failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/update.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm=>/update.exe


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm


    Update failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm=>/file.exe


    Infected with: Trojan.Downloader.Small.PS

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm=>/file.exe


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm


    Update failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm=>/q.htm


    Infected with: Exploit.Html.Codebase.Exec.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm=>/q.htm


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm=>/q.htm


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm


    Update failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\counter[1].html


    Infected with: Trojan.Exploit.Html.MHT

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\counter[1].html


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\counter[1].html


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\countme[1].html


    Infected with: Exploit.Html.MhtRedir.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\countme[1].html


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\countme[1].html


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\STEFG56N\counter[1].html


    Infected with: Exploit.Html.MhtRedir.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\STEFG56N\counter[1].html


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\STEFG56N\counter[1].html


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\CAYMLJ08.HTM


    Suspected of: Exploit.Html.MhtRedir.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\CAYMLJ08.HTM


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\CAYMLJ08.HTM


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm=>/q.htm


    Infected with: Exploit.Html.Codebase.Exec.Gen

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm=>/q.htm


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm=>/q.htm


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm


    Update failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm=>/file.exe


    Infected with: Trojan.Downloader.Small.IZ

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm=>/file.exe


    Disinfection failed

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm=>/file.exe


    Deleted

    C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm


    Update failed

    C:\Downloads\Humour\happytogether.exe=>wise0018


    Detected with: Application.Adware.NewDotNet.Dropper

    C:\Downloads\Humour\happytogether.exe=>wise0018


    Deleted

    C:\Downloads\Humour\happytogether.exe


    Update failed

    C:\Downloads\Morgan Codec\Morgan Multimedia M-JPEG Codec v3.0.0.9\Install_3901.exe


    Infected with: Trojan.Downloader.Istbar.JA

    C:\Downloads\Morgan Codec\Morgan Multimedia M-JPEG Codec v3.0.0.9\Install_3901.exe


    Disinfection failed

    C:\Downloads\Morgan Codec\Morgan Multimedia M-JPEG Codec v3.0.0.9\Install_3901.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP162\A0016460.lnk=>C:\Downloads\Morgan Codec\crack_134440846436164.zip=>Morgan Multimedia M-JPEG Codec v3.0.0.9/Install_3901.exe


    Infected with: Trojan.Downloader.Istbar.JA

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP162\A0016460.lnk=>C:\Downloads\Morgan Codec\crack_134440846436164.zip=>Morgan Multimedia M-JPEG Codec v3.0.0.9/Install_3901.exe


    Disinfection failed

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP162\A0016460.lnk=>C:\Downloads\Morgan Codec\crack_134440846436164.zip=>Morgan Multimedia M-JPEG Codec v3.0.0.9/Install_3901.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP162\A0016460.lnk=>C:\Downloads\Morgan Codec\crack_134440846436164.zip


    Updated

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP162\A0016460.lnk


    Updated

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016948.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016948.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016957.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016957.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016972.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016972.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016982.exe


    Infected with: Trojan.Click.526

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016982.exe


    Disinfection failed

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP168\A0016982.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP169\A0016994.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP169\A0016994.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP171\A0017034.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP171\A0017034.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017086.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017086.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017094.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017094.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017104.exe


    Infected with: Trojan.Click.526

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017104.exe


    Disinfection failed

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017104.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017107.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017107.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017117.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017117.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017127.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017127.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017137.exe


    Infected with: Trojan.Dropper.Vidro.P

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017137.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017145.exe


    Infected with: Trojan.Click.526

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017145.exe


    Disinfection failed

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017145.exe


    Deleted

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017148.exe


    Infected with: Trojan.Downloader.Istbar.JA

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017148.exe


    Disinfection failed

    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP173\A0017148.exe


    Deleted

    C:\WINDOWS\system32\max3548.dll


    Infected with: Trojan.Agent.CO

    C:\WINDOWS\system32\max3548.dll


    Disinfection failed

    C:\WINDOWS\system32\max3548.dll


    Delete failed

    And the Panda Log:

    Incident Status Location

    Virus:Trj/Agent.PN Disinfected Operating system
    Spyware:Spyware/AdClicker No disinfected Windows Registry
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Alan.MAIN\Favorites\Online Sex Poker Rooms.url
    Spyware:Spyware/WareOut No disinfected Windows Registry
    Virus:Trj/Downloader.DGV Disinfected C:\Documents and Settings\Alan\Local Settings\Temporary Internet Files\Content.IE5\N5N45JBK\style[2].css
    Virus:Exploit/Mhtredir.gen Disinfected C:\Documents and Settings\Alan\Local Settings\Temporary Internet Files\Content.IE5\UOL3J2HB\CAWX2389.HTM
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Alan.MAIN\Favorites\Online Sex Poker Rooms.url
    Spyware:Spyware/XXXToolbar No disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\CAL5JMIH.HTM
    Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\classload[1].jar[GetAccess.class]
    Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\classload[1].jar[InsecureClassLoader.class]
    Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\classload[1].jar[Dummy.class]
    Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\classload[1].jar[Installer.class]
    Virus:Trj/Vidro.A Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\count[1].gif
    Virus:Exploit/Codebase.Y No disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm[exec.htm]
    Virus:Exploit/Codebase.Y No disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm[x.htm]
    Virus:Trj/Vidro.A No disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\452BKPSF\x[1].chm[update.exe]
    Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\698RYDI7\archive[1].jar[Dummy.class]
    Virus:Trj/Downloader.CYL No disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm
    Adware:Adware/MSSearch No disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\KHOFG76B\615[1].chm[q.htm]
    Virus:Trojan Horse Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\help[1].chm
    Virus:Exploit/HHelp Disinfected C:\Documents and Settings\Alan.MAIN\Local Settings\Temporary Internet Files\Content.IE5\W5KDSF23\index[3].html
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\AdultGambling.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\Free Online Dating.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\**** Real Girls.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\Kill Annoying Popups.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\Online Sex Poker Rooms.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\Play Adult-Poker.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\Remove Toolbars.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\Spyware Uninstall.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\All Users\Favorites\XXX personal photos.url
    Virus:Trj/Agent.PN Disinfected C:\WINDOWS\system32\max3548.dll


    Thanks for your help so far with this. It's much appreciated.

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Please download, install, and run Cleanup 4.0
    http://cleanup.stevengould.org/


    Then follow these steps...


    Step 1
    Download CWShredder but don't run it yet.


    Step 2
    Download Ad-aware SE 1.06
    Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


    Step 3
    Make sure that you can VIEW ALL HIDDEN FILES.


    Step 4
    Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

    R3 - URLSearchHook: (no name) - {6BAC7C77-7525-2F88-DF1A-D7D75B7FF060} - NopeZ.dll (file missing)
    O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-716D61783548} - C:\WINDOWS\System32\max3548.dll (file missing)
    O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
    O4 - HKLM\..\Run: [systemdll] wormexe.exe
    O4 - HKLM\..\Run: [iehelper] NsCplTray.exe
    O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
    O4 - HKCU\..\Run: [WhatsNewBot] 34763.exe
    O4 - HKCU\..\Run: [porka_] SysSupport.exe
    O4 - HKCU\..\Run: [AppMasterCenter] NSYSCPLSTR.exe
    O16 - DPF: {004DF9D9-566D-11D7-B77D-00E018901A05} - http://195.197.231.3/iqeye.ocx
    O16 - DPF: {304171C0-65EA-4B51-B5D9-93A311E26EB1} - http://219.101.248.138:8106/cgi-bin...b?dummy=3355759
    O16 - DPF: {CF38E898-0A6B-11D6-83C6-0080AD7D6076} (NPRemvuPluginControl) - http://192.168.125.95/webpages/NPRemvu.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{16B778A2-9BAF-43D3-8B65-B3FBC0B9C2A9}: NameServer = 69.50.176.196,195.225.176.110
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5586C11E-050F-4483-963F-D634BC1BCF5A}: NameServer = 69.50.176.196,195.225.176.110
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CB5D945A-E543-43C5-93F8-E747D4E6F1BC}: NameServer = 69.50.176.196,195.225.176.110
    O20 - Winlogon Notify: style2 - C:\WINDOWS\q1175171_disk.dll


    Step 5
    Reboot your computer into SAFE MODE


    Step 6
    Now run CWShredder, making sure to click "Fix".


    Step 7
    Then delete these files or directories (Do not be concerned if they do not exist)

    C:\WINDOWS\q1175171_disk.dll
    C:\Program Files\WareOut
    wormexe.exe
    NsCplTray.exe
    34763.exe
    SysSupport.exe
    NSYSCPLSTR.exe


    Step 8
    Run a full scan with Adaware.


    Reboot your computer to go back to normal mode and post a new hijackthis log.
  • AlanC
    edited July 2005
    Buckeye Sam, www.stevengould.org doesn't exist. Your link failed so I did a search on Google but that link failed too.

    Any ideas?

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    The link works fine for me. Can you try it again? His site may have been down when you tried it.
  • AlanC
    edited July 2005
    Nope, tried in Netscape and IE. Still can't connect.

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    The link works, so that may be another problem we'll have to look at.

    Try CCleaner.
    http://www.ccleaner.com/

    It does about the same thing and it's also freeware.
  • AlanC
    edited July 2005
    Hi again. Sorry for the delay in replying but I can no longer access the internet from my infected pc at home. Had to wait until I got into the office this morning.

    I eventually managed to download "Cleanup". I think the link was down for about 30 minutes or so.

    After running Cleanup I got as far as rebooting in safe mode. At that point I realised that I hadn't already downloaded CWShredder so I tried to get onto the internet to do so. I can no longer access the internet. I checked all my settings and they all seem ok. I can access the remote server at my office but can't get onto any websites.

    Apart from that small problem, I looked for the files that you suggested should be deleted. Only one remained "O20 - Winlogon Notify: style2 - C:\WINDOWS\q1175171_disk.dll". I tried to delete this manually but it wouldn't let me delete it. However, I was able to rename it and since doing so I no longer have the symptoms caused by the virus. HOORAY!!!

    Any idea what can be causing the internet problem.

    Thanks in anticipation.

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Try this...

    Enter your control panel. If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically

    Press OK twice to get out of the properties screen and reboot if it asks.



    If that doesn't do the trick, download and run Winsock Fix.

    http://www.majorgeeks.com/download4372.html



    Post a new hijackthis log as soon as you are able.
  • AlanC
    edited July 2005
    Thanks Sam (or do you prefer Buckeye)

    I already set "Obtain DNS servers automatically" when I was checking my settings.

    Thanks for the pointer but I went to Majorgeeks this morning and downloaded Winsock Fix. I shall try it tonight when I get home.

    Any idea how this happened? Is it related to the virus or has it anything to do with the cleanup I did yesterday?

    Thanks again for your help.

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    It's not uncommon when removing malware to suffer connection problems.

    You do have a new strain of a CoolWebSearch, so running CWShredder is a vital step. I haven't dealt with this one yet, so it may have affected your connection.
  • AlanC
    edited July 2005
    Thanks, I'll let you know of any developments (good or bad)

    Alan
  • AlanC
    edited July 2005
    I'm back and a lot happier.

    'Winsock Fix' fixed my internet connection problem. A big thanks for that.

    I have run CWShredder and attach the latest HijackThis log.

    Logfile of HijackThis v1.99.1
    Scan saved at 20:18:14, on 04/07/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\htpatch.exe
    C:\Apps\ActivBoard\MMKeybd.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Apps\ActivBoard\TrayMon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Apps\ActivBoard\OSD.exe
    C:\Apps\ActivBoard\nhksrv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Common Files\LapLink\Scheduler\llsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\COMMON~1\LapLink\SCHEDU~1\LLSchEng.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\Program Files\Mainconcept\PVR\PvrLauncher.exe
    C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
    C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\r_server.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\hiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://memberservices.passport.net/ppsecure/MSRV_ResetPW.srf?lc=1033
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
    O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
    O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [LapLink Scheduler] C:\Program Files\Common Files\LapLink\Scheduler\llsched.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: PVR Launcher.lnk = ?
    O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
    O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
    O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://clearly.axiscam.net:263/activex/AMC.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://procam3.proserve.nl/activex/AxisCamControl.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://axis.axiscam.net/activex/AMC.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\System32\r_server.exe" /service (file missing)
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

    I'm a bit suspicious about
    "O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet"
    and
    "O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)"

    but it's certainly looking a lot healthier and I got rid of the annoying "windows explorer problem" dialogue that was flashing up every few seconds.

    Thanks again.

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    I'm a bit suspicious about
    "O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet"
    and
    "O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)"

    These are ok. The first one is associated with your nVidia graphics card, and the 09 line is from running the Bit Defender online scan.



    Your log looks clean!

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
  • AlanC
    edited July 2005
    OK, I had already done most of that. I use Kerio firewall and also have the one in my router. Even though I rarely use IE I checked the settings and they were all set as you recommended. I have always had AVG Anti Virus and update it regularly. I use Netscape 7.2 but have just updated that to 8.0.

    I have now installed Spyware Blaster and will keep it updated, together with all other essentials.

    According to AVG I don't have any viruses but I am concerned about a dialogue box that keeps popping up with:

    Windows Security Centre

    WARNING: Windows Firewall detected suspicious network activity on
    your computer. Malicious software codes try to steal your privacy
    information, such as credit card numbers, electronic mail accounts,
    financial data or passwords.

    Do you want to learn how to protect your computer?

    I always close this because I'm pretty sure that I don't use Windows Firewall.

    Is it a 'beasty' do you think?

    Alan
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    I would recommend updating to Service Pack 2. The firewall that comes with Windows is much improved with SP2. As long as you don't get any of those same messages from Kerio then I wouldn't worry about it.
  • AlanC
    edited July 2005
    Thanks, I was going to go for SP2 last night but I ran out of time.

    I think I'm all done here.

    Thanks a million.

    Alan
This discussion has been closed.