vcmain.exe, vcclient.exe, computer reboot

mattandrewmattandrew
edited March 2006 in Spyware & Virus Removal
Hi

firstly what an excellant forum.

ok im trying to sort a friends pc. installed broadband on the pc, connected it to internet and think its got sasser worm virus.

I have run symantec fix blast nothing found

fixsasser is searching at the minute, did not find anything

Just installed service pack 2, but not done latest updates.

When i reboot get two pop up screens the first says sumthing about vcmain.exe and the second vcclient.exe.

when i try to connect to the internet after a short while it says its going to reboot in and starts to count down.

Any reccomendations welcome

Comments

  • mattandrewmattandrew
    edited March 2006
    i have just run hijackthis and below is my result

    Logfile of HijackThis v1.99.1
    Scan saved at 22:31:27, on 13/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    C:\WINDOWS\system32\microsloft.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Common Files\Windows\services32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\default\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {20D57A66-F7DF-467d-907B-9B7F4A118AB7} - C:\WINDOWS\System32\mljig.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [wlib32] rundll32.exe C:\WINDOWS\System32\wlib32.dll,start
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    O4 - HKLM\..\Run: [keyboard] C:\\keyboard1.exe
    O4 - HKLM\..\Run: [Microsoft Configururation 32] microsloft.exe
    O4 - HKLM\..\RunServices: [Microsoft Configururation 32] microsloft.exe
    O4 - HKLM\..\RunOnce: [0000 - C:\Documents and Settings\default\Start Menu\Programs\HP DeskJet 640C Series v2.4] C:\WINDOWS\command.com /c rmdir "C:\Documents and Settings\default\Start Menu\Programs\HP DeskJet 640C Series v2.4"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000228.exe
    O4 - HKCU\..\Run: [Microsoft Configururation 32] microsloft.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.euro.dell.com/countries/uk/enu/gen/default.htm (file missing) (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: Win32 Classes -
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientInstall/7.20.0003/OCI/setup.exe
    O20 - Winlogon Notify: mljig - C:\WINDOWS\SYSTEM32\mljig.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    Hi,

    Please download VundoFix.exe to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will shutdown your computer, click OK.
    • Turn your computer back on.
    • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
  • mattandrewmattandrew
    edited March 2006
    Just waiting for it to restart its taking ages since i upated to service pack2, infact way to long.

    **************

    VundoFix V4.2.33

    Checking Java version...

    Sun Java not detected
    Scan started at 4:05:54 AM 14/03/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\mljig.dll

    Attempting to delete C:\WINDOWS\system32\mljig.dll
    C:\WINDOWS\system32\mljig.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!


    **********************


    Logfile of HijackThis v1.99.1
    Scan saved at 04:16:21, on 14/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
    C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\microsloft.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\default\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O2 - BHO: (no name) - {20D57A66-F7DF-467d-907B-9B7F4A118AB7} - C:\WINDOWS\system32\mljig.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [wlib32] rundll32.exe C:\WINDOWS\System32\wlib32.dll,start
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    O4 - HKLM\..\Run: [Microsoft Configururation 32] microsloft.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\RunServices: [Microsoft Configururation 32] microsloft.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Microsoft Configururation 32] microsloft.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.euro.dell.com/countries/uk/enu/gen/default.htm (file missing) (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientInstall/7.20.0003/OCI/setup.exe
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37680.cab
    O20 - Winlogon Notify: Explorer - C:\WINDOWS\system32\lv2809fue.dll
    O20 - Winlogon Notify: mljig - C:\WINDOWS\SYSTEM32\mljig.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe


    ****************



    when i restart i get a windows box pop up saying:
    An exeption occurred while trying to run ""C:\WINDOWS\system32\dsskmon.dll",DllGetversion"
    The time before it was sci_ci.dll and time before that think it was sumthin different.


    ************


    also when browsing web sometimes get a pop up with "count1.excitechange.com" in the webaddress, is this sum kind of spyware


    thnaks in advance
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    Well now you have a Look2Me infection as well as Vundo. Let's try the look2me fix first. After you run the below fix for the look2me try to run the VundoFix.exe again. Follow the instructions below for the look2me:

    Please download Look2Me-Destroyer.exe to your desktop.
    • Close all windows before continuing.
    • Double-click Look2Me-Destroyer.exe to run it.
    • Put a check next to Run this program as a task.
    • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
    • When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
    • Once it's done scanning, click the Remove L2M button.
    • You will receive a Done Scanning message, click OK.
    • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
    • Your computer will then shutdown.
    • turn your computer back on.
    • Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.

    If you receive a message from your firewall about this program accessing the internet please allow it.

    If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
    http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

    After you run this try the VundoFix.exe file again. Post that log along with the Look2Me log and a fresh Hijack This log.
  • mattandrewmattandrew
    edited March 2006
    Think im gettin sumwhere


    Look2Me-Destroyer V1.0.10

    Scanning for infected files.....
    Scan started at 14/03/2006 15:10:05

    Infected! C:\WINDOWS\system32\lv2809fue.dll
    Infected! C:\WINDOWS\SYSTEM32\dsskmon.dll
    Infected! C:\WINDOWS\SYSTEM32\q668lgju16o8.dll
    Infected! C:\WINDOWS\SYSTEM32\lv2809fue.dll
    Infected! C:\WINDOWS\SYSTEM32\q6rqlg9516.dll
    Infected! C:\WINDOWS\SYSTEM32\lv0809due.dll
    Infected! C:\WINDOWS\SYSTEM32\wHvemsp.dll
    Infected! C:\WINDOWS\SYSTEM32\medex.dll
    Infected! C:\WINDOWS\SYSTEM32\nkmsevt.dll
    Infected! C:\WINDOWS\system32\guard.tmp

    Attempting to delete infected files...

    Attempting to delete: C:\WINDOWS\system32\lv2809fue.dll
    C:\WINDOWS\system32\lv2809fue.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\dsskmon.dll
    C:\WINDOWS\SYSTEM32\dsskmon.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\q668lgju16o8.dll
    C:\WINDOWS\SYSTEM32\q668lgju16o8.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\lv2809fue.dll
    C:\WINDOWS\SYSTEM32\lv2809fue.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\q6rqlg9516.dll
    C:\WINDOWS\SYSTEM32\q6rqlg9516.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\lv0809due.dll
    C:\WINDOWS\SYSTEM32\lv0809due.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\wHvemsp.dll
    C:\WINDOWS\SYSTEM32\wHvemsp.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\medex.dll
    C:\WINDOWS\SYSTEM32\medex.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\SYSTEM32\nkmsevt.dll
    C:\WINDOWS\SYSTEM32\nkmsevt.dll Deleted successfully!

    Attempting to delete: C:\WINDOWS\system32\guard.tmp
    C:\WINDOWS\system32\guard.tmp Deleted successfully!

    Making registry repairs.

    Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}"
    HKCR\Clsid\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BD472F60-27FA-11cf-B8B4-444553540000}"
    HKCR\Clsid\{BD472F60-27FA-11cf-B8B4-444553540000}

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"
    HKCR\Clsid\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{FEF10FA2-355E-4e06-9381-9B24D7F7CC88}"
    HKCR\Clsid\{FEF10FA2-355E-4e06-9381-9B24D7F7CC88}

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{53C74826-AB99-4d33-ACA4-3117F51D3788}"
    HKCR\Clsid\{53C74826-AB99-4d33-ACA4-3117F51D3788}

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{952614EB-B7E2-4A38-B34E-04FFB0FA0232}"
    HKCR\Clsid\{952614EB-B7E2-4A38-B34E-04FFB0FA0232}

    Restoring Windows certificates.

    Replaced hosts file with default windows hosts file


    Restoring SeDebugPrivilege for Administrators - Succeeded


    ************************************************


    VundoFix V4.2.33

    Checking Java version...

    Sun Java not detected
    Scan started at 3:23:14 PM 14/03/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\khfde.dll
    C:\WINDOWS\system32\edfhk.ini
    C:\WINDOWS\system32\edfhk.bak1

    C:\WINDOWS\SYSTEM32\edfhk.bak1
    C:\WINDOWS\SYSTEM32\edfhk.ini
    C:\WINDOWS\SYSTEM32\khfde.dll
    Attempting to delete C:\WINDOWS\system32\khfde.dll
    C:\WINDOWS\system32\khfde.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\edfhk.ini
    C:\WINDOWS\system32\edfhk.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\edfhk.bak1
    C:\WINDOWS\system32\edfhk.bak1 Has been deleted!

    Performing Repairs to the registry.
    Done!


    **************************************************



    Logfile of HijackThis v1.99.1
    Scan saved at 15:45:13, on 14/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
    C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    C:\WINDOWS\system32\microsloft.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\default\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    O4 - HKLM\..\Run: [Microsoft Configururation 32] microsloft.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [ifdrv] rundll32.exe C:\WINDOWS\system32\ifdrv.dll,start
    O4 - HKLM\..\RunServices: [Microsoft Configururation 32] microsloft.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Microsoft Configururation 32] microsloft.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.euro.dell.com/countries/uk/enu/gen/default.htm (file missing) (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientInstall/7.20.0003/OCI/setup.exe
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37680.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe



    *************************************************


    zone alarm is now blocking one item every few seconds, it is the same program: microsloft.exe

    What is it this and how do i remove.

    Thanks in advance any for all what yve done so far
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    It's just more malware trying to start from a startup entry. Download Ewido Anti-Malware from my signature below. Install the program and follow the instructions below to set it up:

    You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update
    • Click on Start

      The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.

      Once the updates are installed do the following:
    • If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.
    • Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.
    • Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!
    • Click on scanner
    • Click on Settings
      • Under "How to scan" all boxes should be selected
      • Under "Possibly unwanted software" all boxes should be selected
      • Under "What to scan" select scan every file
      • Click OK
    • Click on Complete system scan
    • Let the program scan the machine
    • If ewido finds anything, it will pop up a notification. Please select perform action with all infections

      Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
    • Click Save report
    • Save the report to your desktop
    • Exit ewido

    Reboot into normal mode and post the Ewido log along with a fresh Hijack This log.
  • mattandrewmattandrew
    edited March 2006
    think ive got rid of microsloft

    If i Download and instal Ewido Anti-Malware will it conflict with Spbot, zone alarm or AVG? or is it a different kind of program


    Also i have a zone alarm security alert to say "SERVER PROGRAM run a DLL as an App is trying to act as a server" The application is rundll32.exe

    and when I restart I always have to end program on rundll32.exe, how do i stop this coming up.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    Go ahead and download and run Ewido according to the instructions above. You'll be running it in safe mode so there should be no conflicts with other applications. If you have a problem with it let me know and I'll let you know what to disable to make it run properly but I don't expect any problem. Post the Ewido log and a fresh Hijack This log afterward.
  • mattandrewmattandrew
    edited March 2006
    ewido anti-malware - Scan report

    + Created on: 19:49:03, 14/03/2006
    + Report-Checksum: F4A89722

    + Scan result:

    HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned with backup
    HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned with backup
    HKLM\SOFTWARE\PerfectNav -> Adware.KeenValue : Cleaned with backup
    C:\WINDOWS\SYSTEM32\efeef.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\xxwwt.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\khhhi.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\mljig.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\nnnli.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\opnnl.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\ddccy.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\gebbb.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\geeff.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\efeba.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\ARIPPAXX.DLL -> Adware.Look2Me : Cleaned with backup
    C:\WINDOWS\SYSTEM32\nnnnm.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\awvut.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\SYSTEM32\efcbb.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\WINDOWS\TEMP\asmfiles.cab/asm.exe -> Adware.Altnet : Cleaned with backup
    C:\WINDOWS\TEMP\__unin__.exe -> Adware.Altnet : Cleaned with backup
    C:\WINDOWS\TEMP\cd_clint.dll -> Adware.Cydoor : Cleaned with backup
    C:\Program Files\PerfectNav -> Adware.PerfectNav : Cleaned with backup
    C:\Program Files\PerfectNav\BHO -> Adware.PerfectNav : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temp\tmp001a0483 -> Downloader.ConHook.y : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temp\tmp000989f2 -> Downloader.ConHook.y : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temp\tmp0004f964 -> Downloader.ConHook.y : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temp\tmp0005c87c -> Downloader.ConHook.y : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temp\tmp0004ddb2 -> Downloader.ConHook.y : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temp\tmp00084760 -> Downloader.ConHook.y : Cleaned with backup
    C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\K52B01UJ\drdata[1].avi -> Dropper.Agent.aac : Cleaned with backup
    C:\Documents and Settings\default\Desktop\hijackthis\backups\backup-20060314-015233-983.dll -> Downloader.ConHook.y : Cleaned with backup
    C:\mousepad2.exe -> Hijacker.VB.li : Cleaned with backup


    ::Report End


    *************************

    Logfile of HijackThis v1.99.1
    Scan saved at 20:07:09, on 14/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
    C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\default\Desktop\Program setups\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [ifdrv] rundll32.exe C:\WINDOWS\system32\ifdrv.dll,start
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.euro.dell.com/countries/uk/enu/gen/default.htm (file missing) (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientInstall/7.20.0003/OCI/setup.exe
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37680.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

    **************************


    Think im about there???
    or may be not
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    I think we're almost there. Could you please do me a favor? Could you go to Jotti's and upload the following file for analysis:

    C:\WINDOWS\system32\ifdrv.dll

    Please post back with the results of the Jotti scan.
  • mattandrewmattandrew
    edited March 2006
    Ill have to check when i go to my friendsagain, given them thre pc back now.

    But got a problem.

    When i had the computer at my house i connected it to the internet - broadband, using my frineds usb adsl modem with my connection settings (service provider - gotadsl) It all worked ok.

    I then set the computer back up tonight at my friends, i replaced the connection settings with my friends (different service provider to me). I dialed ok the little computer came up in the bottom right corner but when opening internet explorer i got the folling error

    403 Forbidden
    Forbidden
    You were denied access because
    Accsess denied by access contol list

    What does this mean nd what is causing it.

    I have tried my laptop with my friends modem and internet settings at there house any the laptop work fine on the internet, so i know there broadband is ok..

    could it be that my friends computer (the one we have been dealng with all along) has old ISP registy entries that are conflicting
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    Can you tell me more about the error? Can you surf to any web sites at all, and just to clarify, does your friend have dial-up or broadband access?
  • mattandrewmattandrew
    edited March 2006
    They have broadband, tried a few few sites same error. What i cant understand is there connection works ok on my laptop at there house, but there connection does not work on there pc. but it works on my connection at home fine,

    As i said before could it be that my friends computer (the one we have been dealng with all along) has old ISP registy entries that are conflicting.

    I need to some how download something to remove all the old isp registry entrys.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited March 2006
    It's likely something in the way their NIC is set up or an issue with their cable from the DSL/Cable modem to the PC. Make sure the PC knows to connect through a broadband (LAN) type connection and not a dial-up. Go to the control panel and open the network icon. It should show you their connection and whether or not it's active. You can right click on the icon to see the properties. It should be an easy fix. Let me know what you find out.
  • mattandrewmattandrew
    edited March 2006
    The cable is ok i used it when i tried my laptop.

    It connects ok. i know this because the little computer comes up in the bottom right corner to say it is connected ok.

    Cant get to computer right now.

    Like u say it must be something simple.
Sign In or Register to comment.