Please help for Trojan again!

HelpneedHelpneed
edited November 2005 in Spyware & Virus Removal
Trogan_1000, I deeply appreciate for your assistance in previous matter.

I had no problem by yesterday, but today, my computer restarted suddenly; I ran Ad-aware SE, Ewido, MS antispyware, Norton antivirus, and Spybot S&D, but found nothing. I ran a-squared hijack free's online analysis, then it found many viruses and spywares.
I post one of the analysis results here:

Name: gcasServ
Path: C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 1 - Bad: 2
View Details Requires Attention!
Compare details with your local values
and/or search at Google

Name: gcasServ
Good: 1
Bad: 2

Item Details
Name: gcasServ
Good: 1
Bad: 2

Status Name Command Description
X ccApp gcasServ.exe Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name
U gcasServ gcasServ.exe Giant Antipsyware - now superseeded by Microsoft Windows AntiSpyware
X gcasServ realsched.exe Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown


This is only one of the analysis results. If you would be so kind, would you please tell me whether I should post all of the analysis results or not? I ran regedit (from window's run program), but those spywares didn't appear in the registry editor.

I post my HJT log here:

Logfile of HijackThis v1.99.1
Scan saved at 8:19:41 PM, on 11/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
C:\Program Files\Lexmark 7100 Series\ezprint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\lxbxcoms.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
C:\Program Files\BHODemon 2.0.23\BHODemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\Documents and Settings\User\My Documents\Download directory\Antispyware\a2hijackfree1.2 (MGR).exe
C:\Documents and Settings\User\My Documents\Download directory\Antivirus-Spyware\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.javacoolsoftware.com/sbupdate.html
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /startup
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0 -reboot 1
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2.0.23\BHODemon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130265602328
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


I would profoundly appreciate if anyone would give me any suggestions to remove these spywares, and would guide me how to use the a-squared to edit or delete these spywares.

I am awaiting your generous support!

Comments

  • TroganTrogan London, UK
    edited November 2005
    Hi

    Firstly, your HJT log is clean. Secondly, I think that what a2 found is a fasle positive.

    You don't have anything to worry about. :)
  • HelpneedHelpneed
    edited November 2005
    Thanks so much!!!!
    But I have had one more concern: I changed my web browser from IE to Firefox, after I posted this thread for the a-squared analysis. After installing firefox, I ran all spyware tools mentioned above, then Ewido found total "44" infections on the "new" firefox; first time 27, second time 17 infections. Here I post the results:

    ewido security suite - Scan report

    + Created on: 3:34:31 AM, 11/6/2005
    + Report-Checksum: 3AF62313

    + Scan result:

    :mozilla.22:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.23:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.46:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    :mozilla.47:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.48:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.49:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.67:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.68:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.69:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.70:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.71:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.72:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.81:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
    :mozilla.82:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
    :mozilla.95:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    :mozilla.96:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    :mozilla.102:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.103:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.104:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.105:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.106:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.107:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.108:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.120:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
    :mozilla.121:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
    :mozilla.204:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
    :mozilla.205:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup


    ::Report End

    ewido security suite - Scan report

    + Created on: 5:04:02 AM, 11/6/2005
    + Report-Checksum: B83B2155

    + Scan result:

    :mozilla.6:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.7:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.24:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.25:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.80:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.81:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.99:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.100:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.101:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.102:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.130:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    :mozilla.149:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.150:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.151:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.165:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
    :mozilla.166:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
    :mozilla.173:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7531e3ev.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup


    ::Report End

    Should I use IE in lieu of firefox? I would really appreciate if anyone would give me any opinions. Also, I would truly appreciate if anyone would give me any suggestion to detect a possible spyware and virus in my computer.

    Thank you very much!
    I am awaiting your generous assistance!
  • TroganTrogan London, UK
    edited November 2005
    Ewido is finding cookies. Stick with Firefox but you should be careful of what sites you visit.

    You can clear cookies by doing the following;
    • Go Start
    • Control Panel
    • Click on Internet Options
    • Click the General Tab and under Temporary Interent Files click...
    • Delete Cookies...

    Good Luck :)
  • HelpneedHelpneed
    edited November 2005
    I visited only yahoo, msn, and this website since I installed the firefox. Ewido finds no infection after my friends solved the problem.
    I really appreciate for your support!
    If you would be so kind, would you please assist me in another issue?: My web browser can display only 1st to 3rd posts of a thread in this forum, then it goes into a waiting mode; I wait for a long time, but eventually rest of the posts are not displayed. For example, when I click this thread "Please help for Trojan again!", only my first post and your first reply are displayed even I waited more than 5 minutes. This happens everytime I click a thread in this forum.
    I would truly appreciate if you would give me any ideas to solve the problem!
  • TroganTrogan London, UK
    edited November 2005
    What browser is this? IE or Firefox?
  • HelpneedHelpneed
    edited November 2005
    Both IE and Firefox. I have been having this problem for a week.

    Thank you very much! I am awaiting your generous assistance!
  • TroganTrogan London, UK
    edited November 2005
    Uninstall Firefox and Re-download it. Try a different server if possible.

    For IE

    1) find the ie.inf file located in Windows\Inf folder.
    2) Right click the ie.inf file and click Install on the context menu.
    3) Reboot the computer when the file copy process is complete.

    Good Luck :thumbsup:
  • HelpneedHelpneed
    edited November 2005
    I really appreciate for your response!

    The problem still persists for both IE and Firefox.

    Should I ask a support in Emergency Help forum?

    I would deeply appreciate if you would give me any notions to solve the problem!
  • TroganTrogan London, UK
    edited November 2005
    Hmmm :scratch: I'm guessing your using another computer to post?

    Ask for help in the Software or Windows forum BUT not in the EMERGENCY forum as this isn't a case of Emergency :)
  • HelpneedHelpneed
    edited November 2005
    Thank you for your response!

    If you came up any ideas to solve the problem, would you please post it here? I keep this thread open.

    I profoundly appreciate for your time and support you spent for me :)
  • TroganTrogan London, UK
    edited November 2005
    I will post here if I have an idea. Hope you get your browser working.

    Can you post a new HJT log so I can have a final look please :)
  • HelpneedHelpneed
    edited November 2005
    Thank you for sticking with me!!!

    I post my HJT log here:

    Logfile of HijackThis v1.99.1
    Scan saved at 9:33:45 PM, on 11/10/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\ewido\security suite\ewidoctrl.exe
    C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Norton Internet Security\SymProxySvc.exe
    C:\Program Files\Norton Internet Security\NISSERV.EXE
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
    C:\Program Files\Lexmark 7100 Series\ezprint.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Norton Internet Security\IAMAPP.EXE
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    C:\Program Files\BHODemon 2.0.23\BHODemon.exe
    C:\Program Files\Norton Internet Security\ATRACK.EXE
    C:\WINDOWS\system32\lxbxcoms.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\ewido\security suite\SecuritySuite.exe
    C:\Program Files\Norton SystemWorks\Speed Disk\SDNTC.EXE
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\User\My Documents\Download directory\Antivirus\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.javacoolsoftware.com/sbupdate.html
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
    O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
    O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
    O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /startup
    O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2.0.23\BHODemon.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130265602328
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbxcoms.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
    O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • TroganTrogan London, UK
    edited November 2005
    Log looks clear to me.


    Please visit at least two of the following sites for an online virus scan:

    BitDefender Free Online Virus Scan
    http://www.bitdefender.com/scan/licence.php
    Make sure you tick AutoClean under Scan Options.

    Panda ActiveScan
    http://www.pandasoftware.com/activescan/com/activescan_principal.htm
    Make sure you tick Disinfect automatically under Scan Options.

    Housecall at TrendMicro
    http://housecall.trendmicro.com/housecall/start_corp.asp
    Make sure you tick Auto Clean.
    When it completes, post back the full filename of any files that cannot be cleaned or deleted.

    eTrust Antivirus Web Scanner
    http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

    Post the results from the scans you chose
  • HelpneedHelpneed
    edited November 2005
    I solved the problem with Shorty and Leonardo (Team#93)'s great support!
    Thank you very much!!!
This discussion has been closed.