Options

Back again . . .

Unknown
edited October 2005 in Spyware & Virus Removal
Symantec keeps telling me I have viruses, and I was just wondering if you guys good help me clean up my computer so that that stops happening. Here's the hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 12:03:31 AM, on 10/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\mHotkey.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\aim\aim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SECRETMAKER\secretmaker.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://espn.go.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = espn.com
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://students.uconn.edu/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\qnsorrjy.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\qnsorrjy.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINDOWS\system32\smiehlp.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {140F03AE-0588-11D4-BD45-0050048A82BF} (eShare Web Collaboration Class) - http://chat.microsoft.upgrade.com/netagent/objects/emagic.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126357782500
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://137.99.119.88//activex/AMC.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

Thanks much!

Tim

Comments

  • lemonlimelemonlime Canada Member
    edited October 2005
    Hi Tim,

    I looked through your HJT log twice, and I don't see anything out of the ordinary. Hopefully an SVT member will be able to verify this ..

    Do you know what this running process is?
    C:\Program Files\BitLord\BitLord.exe

    Other than that, everything appears legit. Could you let us know exactly which infected files Symantec is detecting, and the virus that is infected?
  • Kanell17
    edited October 2005
    It's a program for downloading from torrents like bittorrent. Nothing bad there . . . I'll let you know what Symantec is telling me later.
  • lemonlimelemonlime Canada Member
    edited October 2005
    Kanell17 wrote:
    It's a program for downloading from torrents like bittorrent. Nothing bad there . . . I'll let you know what Symantec is telling me later.

    Ok, thanks, I wasn't sure.. It could be that you have infected files on your PC, but they are not currently running in memory (which is a good thing), hence the clean HJT log..
  • Kanell17
    edited October 2005
    Here's what Symantec is telling me every time I run Adaware:

    It seems to be making a random folder name that then has files contained in it and it changes every time. When they are cleaned/deleted, they are just remade. They are named "web.exe", "counter.class", "xeyond.class", "verifierbug.class", and "worker.class". They are all found in some folder off of c:\docume~1\owner\locals~1\temp\aawtmp\c56350828(and then in one case \c56350828\b64ca, and in another c22706625\1dfe22). So yeah, I have no idea where these are coming from.

    Tim
  • Kanell17
    edited October 2005
    So does anyone know what those would be?
  • lemonlimelemonlime Canada Member
    edited October 2005
    Hi Kanell17,

    I'm not sure why ad-aware is dumping those files into temporary folders, unless that is where it is trying to isolate found items.

    I think this may actually be a case of two applications (ad-aware and Symantec) simply conflicting with eachother. You may want to temporarily disable Symantec while you do a complete adaware scan, and allow ad-aware to remove any items found.

    Give that a try and let us know if the behavior is any different.

    Please post an updated HJT log once you are finished..

    Thanks,
    Mike
  • Kanell17
    edited October 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 1:40:48 PM, on 10/9/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\mHotkey.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\DIGStream\digstream.exe
    C:\Program Files\D-Link\Air Utility\AirCFG.exe
    C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
    C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\aim\aim.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\tcpsvcs.exe
    C:\WINDOWS\system32\slserv.exe
    C:\Program Files\BigFix\BigFix.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\SECRETMAKER\secretmaker.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\unzipped\hijackthis_199\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = google.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://espn.go.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = espn.com
    F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://students.uconn.edu/"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\qnsorrjy.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\qnsorrjy.slt\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINDOWS\system32\smiehlp.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
    O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
    O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\aim\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
    O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
    O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
    O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
    O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {140F03AE-0588-11D4-BD45-0050048A82BF} (eShare Web Collaboration Class) - http://chat.microsoft.upgrade.com/netagent/objects/emagic.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126357782500
    O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://137.99.119.88//activex/AMC.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
  • lemonlimelemonlime Canada Member
    edited October 2005
    Hi Kanel17,

    Sorry for the delay in getting back to you..

    I took another look at your HJT log file, and it looks clean to me. Nothing malicious in there. Should not be anything running, however there are likely numerous items sitting idle on your hard drive that we need to address..

    Could you disable your anti-spyware and virus scanning applications temporarily, and try to run a Panda Activescan? You can do that online at the following link:
    http://www.pandasoftware.com/products/activescan.htm

    Post Panda's findings back in this thread. Also, during your previous ad-aware scan, was anything removed?

    Best Regards,
    Mike
  • Kanell17
    edited October 2005
    Incident Status Location

    Adware:adware/sahagent No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\cdt1001.sah
    Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\i13CD.tmp
    Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\i848.tmp
    Adware:Adware/Exact.BargainBuddyNo disinfected C:\Documents and Settings\Owner\Local Settings\Temp\temp.fr9171
    Adware:Adware/eZula No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\temp.frE5E2
    Spyware:Spyware/Altnet No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\__unin__.exe
    Spyware:spyware/surfsidekick No disinfected C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Ssk.log
    Spyware:Spyware/New.net No disinfected C:\Program Files\FileSubmit\euro2004cursetv01.zip\NNEZTA388.exe
    Adware:Adware/QuickSearch No disinfected C:\Program Files\FileSubmit\euro2004cursetv01.zip\TBEZA127Q.exe
    Spyware:Spyware/New.net No disinfected C:\Program Files\FileSubmit\ffctheme.zip\NNEZTA388.exe
    Adware:Adware/QuickSearch No disinfected C:\Program Files\FileSubmit\ffctheme.zip\TBEZA127Q.exe
    Adware:Adware/WUpd No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.1\DeskAdX.dll
    Adware:Adware/WUpd No disinfected C:\WINDOWS\Downloaded Program Files\DeskAdX.dll
    Adware:adware/sidesearch No disinfected C:\WINDOWS\sepsd.bin
    Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\system32\BO2802040128.exe
    Spyware:spyware/linkreplacer No disinfected C:\WINDOWS\system32\lmdv.bin
    Spyware:Spyware/LinkReplacer No disinfected C:\WINDOWS\system32\PreUninstall.exe
    Spyware:Spyware/LinkReplacer No disinfected C:\WINDOWS\system32\uninst.exe
    Adware:adware/ezula No disinfected C:\WINDOWS\woinstall.exe
    I don't know of anything intense that was removed during adaware last time, but symantec hasn't been bugging out when I've rain Adaware, so that has to be a good sign. Thanks.
  • lemonlimelemonlime Canada Member
    edited October 2005
    Hi Kanel17,

    Panda Active scan has found quite a few rementants of spyware on your hard drive that needs to be removed. Please do the following:

    1) Boot up your computer into Safe Mode (Hit F8 just before the windows loading screen appears after a reboot). More info on how to get to safe mode here: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx

    2) Ensure that hidden/system files can be viewed. You can get more information on how to enable this here: http://www.short-media.com/forum/showpost.php?p=172588&postcount=3

    3) Quarantine the following files on your hard drive, using the following instructions.. do not delete the files yet: http://www.short-media.com/forum/showpost.php?p=173532&postcount=5

    C:\Documents and Settings\Owner\Local Settings\Temp\cdt1001.sah
    C:\Documents and Settings\Owner\Local Settings\Temp\i13CD.tmp
    C:\Documents and Settings\Owner\Local Settings\Temp\i848.tmp
    C:\Documents and Settings\Owner\Local Settings\Temp\temp.fr9171
    C:\Documents and Settings\Owner\Local Settings\Temp\temp.frE5E2
    C:\Documents and Settings\Owner\Local Settings\Temp\__unin__.exe
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Ssk.log
    C:\Program Files\FileSubmit\euro2004cursetv01.zip\NNEZTA388.e xe
    C:\Program Files\FileSubmit\euro2004cursetv01.zip\TBEZA127Q.e xe
    C:\Program Files\FileSubmit\ffctheme.zip\NNEZTA388.exe
    C:\Program Files\FileSubmit\ffctheme.zip\TBEZA127Q.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\DeskAdX.dll
    C:\WINDOWS\Downloaded Program Files\DeskAdX.dll
    C:\WINDOWS\sepsd.bin
    C:\WINDOWS\system32\BO2802040128.exe
    C:\WINDOWS\system32\lmdv.bin
    C:\WINDOWS\system32\PreUninstall.exe
    C:\WINDOWS\system32\uninst.exe
    C:\WINDOWS\woinstall.exe

    Please make a note of any files you could not find or copy.

    4) Clear your temporary internet files (browser cache): http://www.microsoft.com/windows/ie/using/howto/customizing/clearcache.mspx

    5) Reboot your computer into normal mode, run another Panda active scan, as well as another HJT scan, and post the results of both into this thread..

    :thumbsup:
Sign In or Register to comment.