HELP!!!! Desktop Hijacked

TheDark12TheDark12
edited October 2005 in Spyware & Virus Removal
Hello everyone,
I need some help. Yet again a virus/spyware object has hijacked not only my browser, but my desktop too! There was a thing saying:
Warning!
There may be spyware on your computer (Or something I dont remember what it says)
That turned up, on top of my desktop. Also, when I went to properties on the desktop some of the tabs had disappeared.
Now however the desktop is black (so I cant see the message anymore) and the tabs in properties are back.
I dont know what I have done yet but I am constantly scanning and updating with Adaware and Ewido.
Here is my hijack this log: any help in identifying problems here will be GREATLY appreciated. I have an assignment due this friday and thanks to this virus I cant do my research, as it locks down random pages (mostly the ones with how to FIX this virus!)


Logfile of HijackThis v1.99.1
Scan saved at 5:19:11 PM, on 3/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\acs.exe
E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
E:\Program Files\ewido\security suite\ewidoctrl.exe
E:\Folding@Home\FAH502-Console.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\Folding@Home\FahCore_78.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\system32\shnlog.exe
E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\WINDOWS\system32\CTHELPER.EXE
E:\Program Files\Microsoft Hardware\Keyboard\type32.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
E:\Program Files\NetLimiter\NetLimiter.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
E:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
E:\WINDOWS\system32\intmon.exe
E:\WINDOWS\system32\intmon.exe
E:\Program Files\Internet Explorer\iexplore.exe
F:\hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - E:\WINDOWS\system32\hpCB4E.tmp
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SiSUSBRG] E:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Samsung LBP SM] "E:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [RegSvr32] E:\WINDOWS\system32\msmsgs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SP2ConnPatcher] "E:\Program Files\SP2 Connection Patcher\sp2connpatcher.exe" -n=200
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = E:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Send To &Bluetooth - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'e:\program files\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114563049047
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - E:\WINDOWS\system32\btxppanel.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - E:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - E:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: [email]FAH@E:+Folding@Home+FAH502-Console.exe[/email] - Stanford University - E:\Folding@Home\FAH502-Console.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe


Thanks for any help you can offer.
- TheDark12

Comments

  • TheDark12TheDark12
    edited October 2005
    Well, I solved my problem by:
    Turning off system restore
    Attacking everything in HiJack this (probably not recommended in future)
    Rebooting to safe mode
    Running a scan with Adaware
    Running a scan with Ewido
    Rebooting

    Ewido found a virus file named pkk.exe, adaware found everything else.
    If anyone could please spare the time to check through my HiJack This log for me, just to make sure I havent missed any nasties I would really appreciate that.

    Logfile of HijackThis v1.99.1
    Scan saved at 12:21:03 AM, on 4/10/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\WINDOWS\system32\acs.exe
    E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    E:\Program Files\ewido\security suite\ewidoctrl.exe
    E:\Program Files\ewido\security suite\ewidoguard.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\system32\wscntfy.exe
    E:\WINDOWS\Explorer.EXE
    E:\WINDOWS\system32\CTHELPER.EXE
    E:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    E:\WINDOWS\system32\rundll32.exe
    E:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
    E:\Program Files\NetLimiter\NetLimiter.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\NETGEAR\WPN311\wlancfg5.exe
    E:\Program Files\Internet Explorer\iexplore.exe
    F:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Samsung LBP SM] "E:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
    O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
    O4 - HKLM\..\Run: [RegSvr32] E:\WINDOWS\system32\msmsgs.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SP2ConnPatcher] "E:\Program Files\SP2 Connection Patcher\sp2connpatcher.exe" -n=200
    O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = E:\Program Files\NETGEAR\WPN311\wlancfg5.exe
    O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Send To &Bluetooth - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O10 - Broken Internet access because of LSP provider 'e:\program files\newdotnet\newdotnet6_38.dll' missing
    O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - E:\WINDOWS\system32\acs.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - E:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe

    Thanks alot for any help ;)
    - TheDark12
  • lemonlimelemonlime Canada Member
    edited October 2005
    Log does not look too out of the ordinary to me :thumbsup: . I am hoping an SVT team member can verify this for me.

    The only item of concern to me is the following:

    O10 - Broken Internet access because of LSP provider 'e:\program files\newdotnet\newdotnet6_38.dll' missing

    It appears that you may have had the 'NewDotNet' application installed, which is considered spyware. Ad-aware may have already taken care of that, but you may want to address any reminants of that application. You can remove the above item from HJT.

    You can find some more information here: http://www.iamnotageek.com/a/newdotnet6_38.dll.php

    Also, just to be sure, could you copy and paste the contents of your hosts file? You can find it in your \Windows\System32\drivers\etc folder. To open it, right click it, select 'Open With' and use 'Notepad'.

    Thanks,
    Mike.
  • TheDark12TheDark12
    edited October 2005
    Thanks ALOT man, I didn't see that entry myself, thanks for spotting it. I tried to remove it but it said to get a ecertain removal tool or use spybot s&d
    So I'll try that first and get back to you.

    In my hosts file I see the following:

    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost

    I used a file called lspfix and my new HJT log looks like this:
    Logfile of HijackThis v1.99.1
    Scan saved at 10:37:11 AM, on 4/10/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\WINDOWS\system32\acs.exe
    E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    E:\Program Files\ewido\security suite\ewidoctrl.exe
    E:\Program Files\ewido\security suite\ewidoguard.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\Ati2evxx.exe
    E:\WINDOWS\Explorer.EXE
    E:\WINDOWS\system32\wscntfy.exe
    E:\WINDOWS\system32\CTHELPER.EXE
    E:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    E:\WINDOWS\system32\rundll32.exe
    E:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
    E:\Program Files\NetLimiter\NetLimiter.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\Messenger\msmsgs.exe
    E:\Program Files\NETGEAR\WPN311\wlancfg5.exe
    E:\Program Files\BitLord\BitLord.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Internet Explorer\iexplore.exe
    E:\Program Files\Windows Media Player\wmplayer.exe
    F:\hijackthis\HijackThis.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Samsung LBP SM] "E:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
    O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
    O4 - HKLM\..\Run: [RegSvr32] E:\WINDOWS\system32\msmsgs.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: NETGEAR WPN311 Wireless Assistant.lnk = E:\Program Files\NETGEAR\WPN311\wlancfg5.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - E:\WINDOWS\system32\acs.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - E:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe

    Thanks again for your help, finally I better get started on my assignment!!!
    - TheDark12

    Please let me know if you find anymore problems :)
Sign In or Register to comment.