Computer hijacked by for me an unknown software.

quick116

Hi!

I'm sitting here with the computer of my father in law.

He said that he had been on some pages looking at girls.... and now he has a problem, and has asked me to try to fix it.

The problem is that 6 icons\images appeares on the right hand of the desktop, and they all contain different "types of flash menus".
The 6 icons\images are called: GAMBLING, DATING, PHARMACY, XXX, SPYWARE AND INSURANCE.
There is also a button that closes theese icons\images.

A new toolbar has also been added to the browser,with the same topics as above. I can not remove the toolbar by means of the standard option in the browser drop menu. All options exept the "customize toolbar" option is locked.

I have tried removing the unwanted software by means of adaware and CWshredder but no go. When running CWshredder the the computer just locks up and ends up with "blue screen" both in normal- and safe mode.

See attached copy of my hijackthis log.

Please advise

Regards

Quick116


Logfile of HijackThis v1.99.1
Scan saved at 22:07:15, on 19.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe
C:\Programfiler\Java\jre1.5.0_04\bin\jusched.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Programfiler\Internet Explorer\IEXPLORE.EXE
C:\Programfiler\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Njaal\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - URLSearchHook: (no name) - {F46633C3-B84B-F303-FB12-B3A64D3D0D86} - NopeZ.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\xwtnv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\xwtnv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programfiler\Fellesfiler\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TRPT] StartCpl.exe
O4 - HKLM\..\Run: [NukeSpan] StatusCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [UnSpyPC] "C:\Programfiler\UnSpyPC\UnSpyPC.exe"
O4 - HKCU\..\Run: [backorif] panel_its.exe
O4 - HKCU\..\Run: [EXE32EXE] panel_its.exe
O4 - HKCU\..\Run: [killall] iesetupdll.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120587764132
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A92DC1A-5D4C-483B-A710-A7D88483F4BB}: NameServer = 85.255.113.132,85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B0458C3-57F0-42E3-BC89-5946CD8EC103}: NameServer = 85.255.113.132,85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\..\{E517A630-FCDC-4DC7-BF62-55782DD84117}: NameServer = 85.255.113.132,85.255.112.88
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A92DC1A-5D4C-483B-A710-A7D88483F4BB}: NameServer = 85.255.113.132,85.255.112.88
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programfiler\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FELLES~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe

SpywareShooter

[STEP 1] Fix HijackThis Entries:

Fix the following entries with HijackThis by placing checkmarks in the boxes next to them and clicking "Fix Checked".

R3 - URLSearchHook: (no name) - {F46633C3-B84B-F303-FB12-B3A64D3D0D86} - NopeZ.dll (file missing)
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\xwtnv.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\xwtnv.dll
O4 - HKLM\..\Run: [TRPT] StartCpl.exe
O4 - HKLM\..\Run: [NukeSpan] StatusCheck.exe
O4 - HKCU\..\Run: [UnSpyPC] "C:\Programfiler\UnSpyPC\UnSpyPC.exe"
O4 - HKCU\..\Run: [backorif] panel_its.exe
O4 - HKCU\..\Run: [EXE32EXE] panel_its.exe
O4 - HKCU\..\Run: [killall] iesetupdll.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A92DC1A-5D4C-483B-A710-A7D88483F4BB}: NameServer = 85.255.113.132,85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B0458C3-57F0-42E3-BC89-5946CD8EC103}: NameServer = 85.255.113.132,85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\..\{E517A630-FCDC-4DC7-BF62-55782DD84117}: NameServer = 85.255.113.132,85.255.112.88
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A92DC1A-5D4C-483B-A710-A7D88483F4BB}: NameServer = 85.255.113.132,85.255.112.88

[STEP 2] Remove Malicious Files:

Locate the following files using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.

C:\WINDOWS\system32\xwtnv.dll
StartCpl.exe
StatusCheck.exe
panel_its.exe
iesetupdll.exe

[STEP 3] Remove Malicious Folders:

Locate the following files using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.

C:\Programfiler\UnSpyPC\

[STEP 4]Run Additional Tools:

Your computer is infected with a malicious piece of software known as "WareOut". Removal of this software is much easier with a tool created just for WareOut removal. Please download FixWareout from the link below to your desktop and post the log it gives.:

http://downloads.subratam.org/Fixwareout.exe

[STEP 5]Report Back to us:

Once you have followed all of the steps above please reboot your computer and post a new HijackThis log.