trojan help plz

Unknown
edited May 2007 in Spyware & Virus Removal
i have had a Trojan on my computer for a few days now and haven't been able to get rid of it. It was suggested to me that i start my computer in safe mode and delete these files(i wrote all of the infected file names down) i did so, but now more files are popping up in random places with seemingly random names, can you help me?

Comments

  • Baabiouz
    edited May 2007
    Hi!

    I'll help you here. Let's start with this:

    Please download the self-extracting version of HijackThis from here:

    HijackThis_sfx download

    Save HijackThis_sfx to your desktop.

    Double-click the file then click the Unzip button. Then close the Self-Extractor window.

    Using My Computer/Windows Explorer, navigate to C:\Program Files\HijackThis and double click on HijackThis.exe to run it. If you would like to make a shortcut for your Desktop so it's more easily accessable, right click HijackThis.exe and choose Send To > Desktop (create shortcut).

    Please run the extracted HijackThis.exe from now on. Delete any copies of HijackThis.zip that you have saved.

    Open HijackThis and click Do a system scan and save a log file. Copy the entire contents of that log and post it here by clicking the Add Reply button.
  • dodomn
    edited May 2007
    alright, here's the log:


    Logfile of HijackThis v1.99.1
    Scan saved at 12:15:32 AM, on 5/25/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\WINDOWS\avp.exe
    C:\WINDOWS\smanager.7.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\windows\system32\drivers\uzcx.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\MyWebSearch\bar\1.bin\m3IMPipe.exe
    C:\Documents and Settings\eric\Desktop\utorrent.exe
    C:\Program Files\Trillian\trillian.exe
    C:\WINDOWS\abc5026def.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\agentmon.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\svwin.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\winhost.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\64mon.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\win64.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\agentserver.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\32sv.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\synpower.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\1616.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\DOCUME~1\eric\LOCALS~1\Temp\16mon.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
    O4 - HKLM\..\Run: [RunOnce2Upd] "C:\WINDOWS\system32\KB_963493.exe"
    O4 - HKLM\..\Run: [SManager] smanager.7.exe
    O4 - HKLM\..\Run: [iut75] c:\windows\system32\drivers\uzcx.exe
    O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels32.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\1.bin\m3IMPipe.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Restore Operation] C:\DOCUME~1\eric\LOCALS~1\Temp\svchots.exe
    O4 - HKCU\..\Run: [System update] C:\DOCUME~1\eric\LOCALS~1\Temp\3440.exe
    O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
    O4 - Startup: Shortcut to utorrent.lnk = C:\Documents and Settings\eric\Desktop\utorrent.exe
    O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
  • Baabiouz
    edited May 2007
    Hi!

    Yep, your log looks bad.. Let's start with these:

    Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible.


    #1
    Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

    Mywebsearch
    or My Web , or someone like those..

    Please note any other programs that you dont recognize in that list in your next response

    #2
    Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present):

    C:\Program Files\MyWebSearch

    #4

    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
    This program is for XP and Windows 2000 only!

    Double-click ATF Cleaner.exe to open it.

    Under Main select the following:
    • Windows Temp
    • Current User Temp
    • All Users Temp
    • Temporary Internet Files
    • Prefetch
    • Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.

    Click Exit on the Main menu to close the program.

    #5

    Download SDFix and save it to your Desktop.
    Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

    #6

    Please download Combofix to your desktop.
    Doubleclick combo.exe to launch the application.
    Follow the prompts that will be displayed on the screen.
    Don't click on the window while the fix is running, because that will cause your system to hang.
    When finished, it should produce a log, combofix.txt.
    Post this log in your next reply together with a new hijackthislog.

    #7

    Please, post a new HjT log, SDfix log and Combofix log.
  • dodomn
    edited May 2007
    ok, here are the logs:

    Highjackthis log:

    Logfile of HijackThis v1.99.1
    Scan saved at 3:56:25 PM, on 5/25/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Documents and Settings\eric\Desktop\utorrent.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Trillian\trillian.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [avp] C:\WINDOWS\abc5026def.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Startup: Shortcut to utorrent.lnk = C:\Documents and Settings\eric\Desktop\utorrent.exe
    O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe



    Combofix log:

    "eric" - 2007-05-25 15:15:22 Service Pack 2
    ComboFix 07-05.26.V - Running from: "C:\Documents and Settings\eric\Desktop\"


    (((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    "C:\Documents and Settings\All Users.\documents\settings\desktop.ini"
    "C:\WINDOWS\avp.exe"
    "C:\WINDOWS\system32\klikalka.exe"
    "C:\Documents and Settings\All Users.\documents\settings"


    ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-25 ))))))))))))))))))))))))))))))))))


    2007-05-24 22:01 22,752 --a
    C:\WINDOWS\system32\spupdsvc.exe
    2007-05-24 22:01 <DIR> d--h
    C:\WINDOWS\$hf_mig$
    2007-05-24 22:01 <DIR> d
    C:\WINDOWS\system32\PreInstall
    2007-05-23 23:58 <DIR> d
    C:\Program Files\FunWebProducts
    2007-05-23 22:29 <DIR> d
    C:\WINDOWS\system32\SoftwareDistribution
    2007-05-23 22:22 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\Google
    2007-05-22 10:23 <DIR> d
    C:\Program Files\Common Files\Symantec Shared
    2007-05-22 10:00 <DIR> d
    C:\WINDOWS\system32\runtime
    2007-05-22 10:00 <DIR> d
    C:\Program Files\Norton Security Scan
    2007-05-21 11:43 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\Lavasoft
    2007-05-21 11:41 <DIR> d
    C:\Program Files\Lavasoft
    2007-05-21 11:40 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-05-21 09:03 13,357 --a
    C:\DOCUME~1\eric\u.exe
    2007-05-15 18:40 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\DivX
    2007-05-15 18:38 116,472
    C:\WINDOWS\system32\pxcpyi64.exe
    2007-05-15 18:37 <DIR> d
    C:\Program Files\DivX
    2007-05-14 22:06 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\funkitron
    2007-05-14 20:38 52,338 --a
    C:\WINDOWS\system32\RadLightOggUninstall.exe
    2007-05-14 19:04 <DIR> d
    C:\Program Files\InterActual
    2007-05-12 17:51 <DIR> d
    C:\DOCUME~1\eric\Shared
    2007-05-12 17:51 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\LimeWire
    2007-05-12 17:50 <DIR> d
    C:\Program Files\LimeWire
    2007-05-11 11:54 524,288 --a
    C:\WINDOWS\system32\DivXsm.exe
    2007-05-10 23:02 43,392 --a
    C:\WINDOWS\system32\drivers\Athfmwdl.sys
    2007-05-10 23:02 285,216 --a
    C:\WINDOWS\system32\drivers\wg11tnd5.sys
    2007-05-10 23:02 143,944 --a
    C:\WINDOWS\system32\drivers\ar5523.bin
    2007-05-10 23:02 <DIR> d
    C:\Program Files\WG111T Configuration Utility
    2007-05-10 22:37 823,296 --a
    C:\WINDOWS\system32\divx_xx0c.dll
    2007-05-10 22:37 823,296 --a
    C:\WINDOWS\system32\divx_xx07.dll
    2007-05-10 22:37 802,816 --a
    C:\WINDOWS\system32\divx_xx11.dll
    2007-05-10 22:37 740,442 --a
    C:\WINDOWS\system32\DivX.dll
    2007-05-01 15:34 <DIR> d
    C:\Program Files\Nero
    2007-05-01 15:34 <DIR> d
    C:\Program Files\Common Files\Ahead
    2007-05-01 15:34 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
    2007-05-01 13:28 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\MSNInstaller
    2007-05-01 13:17 <DIR> d
    C:\DOCUME~1\eric\Contacts
    2007-05-01 13:15 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2007-04-30 23:41 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\FunWebProducts
    2007-04-30 23:34 5,600 --a
    C:\WINDOWS\system\WINASPI.DLL
    2007-04-30 23:34 45,056 --a
    C:\WINDOWS\system32\WNASPI32.DLL
    2007-04-30 23:34 4,672 --a
    C:\WINDOWS\system\WOWPOST.EXE
    2007-04-30 23:34 25,244 --a
    C:\WINDOWS\system32\drivers\ASPI32.SYS
    2007-04-30 23:20 <DIR> d
    C:\WINDOWS\system32\appmgmt
    2007-04-29 23:32 368,912 --a
    C:\WINDOWS\system32\vbar332.dll
    2007-04-29 21:59 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\Magic Academy
    2007-04-29 20:05 1,852 --a
    C:\WINDOWS\system32\d3d9caps.dat
    2007-04-29 20:02 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    2007-04-26 09:16 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\Ahead
    2007-04-25 12:27 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
    2007-04-25 11:06 <DIR> d
    C:\DOCUME~1\eric\APPLIC~1\MusicIP


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-05-25 21:17:34
    d
    w C:\DOCUME~1\eric\APPLIC~1\uTorrent
    2007-05-25 05:20:15
    d
    w C:\DOCUME~1\eric\APPLIC~1\OpenOffice.org2
    2007-05-25 04:34:30
    d
    w C:\Program Files\Trillian
    2007-05-24 05:17:29
    d
    w C:\Program Files\Real
    2007-05-21 21:46:04 41 ----a-w C:\WINDOWS\popcinfo.dat
    2007-05-17 05:06:33
    d
    w C:\Program Files\Winamp
    2007-05-13 06:41:50 35 ----a-w C:\WINDOWS\popcinfot.dat
    2007-05-12 23:23:34 1,740 ----a-w C:\WINDOWS\system32\d3d8caps.dat
    2007-04-23 18:00:13
    d
    w C:\Program Files\OpenOffice.org 2.2
    2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2007-04-23 00:15:24 118,520
    w C:\WINDOWS\system32\pxinsi64.exe
    2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
    2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
    2007-04-21 04:48:37 0 ----a-w C:\WINDOWS\popcreg.dat
    2007-04-21 04:42:57 774,144 ----a-w C:\Program Files\RngInterstitial.dll
    2007-04-21 04:42:30
    d
    w C:\Program Files\Common Files\Real
    2007-04-20 04:29:05
    d
    w C:\DOCUME~1\eric\APPLIC~1\Real
    2007-04-19 21:51:52
    d
    w C:\Program Files\Common Files\xing shared
    2007-04-18 17:57:17
    d
    w C:\DOCUME~1\eric\APPLIC~1\Talkback
    2007-04-18 17:57:07 0 ----a-w C:\WINDOWS\nsreg.dat
    2007-04-18 17:23:50 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2007-04-09 04:11:29 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2007-04-09 04:11:29 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
    2007-04-09 03:28:54
    d
    w C:\Program Files\microsoft frontpage
    2007-04-09 03:27:00 0 --sha-r C:\MSDOS.SYS
    2007-04-09 03:27:00 0 --sha-r C:\IO.SYS
    2007-04-09 03:27:00 0 ----a-w C:\CONFIG.SYS
    2007-04-09 03:27:00 0 ----a-w C:\AUTOEXEC.BAT
    2007-04-09 03:22:51
    d--h--w C:\Program Files\WindowsUpdate
    2007-04-09 03:22:42
    d
    w C:\Program Files\Online Services
    2007-04-09 03:21:14
    d
    w C:\Program Files\Common Files\MSSoap
    2007-04-09 03:21:01
    d
    w C:\Program Files\Movie Maker
    2007-04-09 03:19:11 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
    2007-04-09 03:18:13
    d
    w C:\Program Files\Messenger
    2007-04-09 03:18:05
    d
    w C:\Program Files\MSN Gaming Zone
    2007-04-09 03:17:48
    d
    w C:\Program Files\Windows NT
    2007-04-08 21:06:37
    d
    w C:\Program Files\Common Files\ODBC
    2007-04-08 21:06:31
    d
    w C:\Program Files\Common Files\SpeechEngines
    2007-03-07 23:51:00 43,528
    w C:\WINDOWS\system32\drivers\PxHelp20.sys
    2007-03-07 23:51:00 129,784
    w C:\WINDOWS\system32\pxafs.dll


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-24 22:07]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-19 15:51]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-04-23 11:58]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
    "avp"="C:\WINDOWS\abc5026def.exe" []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []

    *Newly Created Service* -PROCEXP90

    Contents of the 'Scheduled Tasks' folder
    2007-05-22 16:00:31 C:\WINDOWS\tasks\Norton Security Scan.job

    ********************************************************************

    catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-05-25 15:17:25
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    ********************************************************************

    Completion time: 2007-05-25 15:19:11
    C:\ComboFix-quarantined-files.txt ... 2007-05-25 15:18

    --- E O F ---


    SDFix Log:

    SDFix: Version 1.85

    Run by eric - Fri 05/25/2007 - 14:52:21.64

    Microsoft Windows XP [Version 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:






    Restoring Windows Registry Values
    Restoring Windows Default Hosts File
    Restoring Missing Security Center Service
    Restoring Missing SharedAccess Service

    Rebooting...


    Normal Mode:
    Checking Files:

    Below files will be copied to Backups folder then removed:

    C:\WINDOWS\abc5026def.exe - Deleted
    C:\WINDOWS\smanager.7.exe - Deleted
    C:\WINDOWS\system32\RunOnce2.t__ - Deleted
    C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted
    C:\WINDOWS\system32\wsnpoem\video.dll - Deleted


    Folder C:\WINDOWS\system32\wsnpoem - Removed

    Removing Temp Files...

    ADS Check:

    Checking if ADS is attached to system32 Folder
    C:\WINDOWS\system32
    No streams found.

    Checking if ADS is attached to svchost.exe
    C:\WINDOWS\system32\svchost.exe
    No streams found.



    Final Check:

    Remaining Services:



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    Remaining Files:

    Backups Folder: - C:\SDFix\backups\backups.zip

    Checking For Files with Hidden Attributes:

    C:\Program Files\InterActual\InterActual Player\itiC1.tmp

    Finished
  • Baabiouz
    edited May 2007
    Hi!

    Now your log looks much more better. :)

    #1
    Please open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below:

    O4 - HKLM\..\Run: [avp] C:\WINDOWS\abc5026def.exe
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZJfox000

    Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

    #2
    • Launch AVG Anti-Spyware.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    Once in Safe Mode:

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Automatically generate report after every scan and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        scanavgjk2.jpg
    • When done, click the Save Scan Report button. (4)
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware log.
  • dodomn
    edited May 2007
    Umm, i don't have all those options that you said i should have, i turned off Resident Shield and the Auto Updater by going in to properties, but i don't have the same Settings options and none of my AVG screens look like the picture you posted. Am i running a different version of AVG? I'm currently using AVG 7.5.
  • Baabiouz
    edited May 2007
    Jep. That picture is undated. Mine AVG doesn't looks like that picture.
  • dodomn
    edited May 2007
    So, since i should have these same options and controls, where would they be? i can't seem to find any of them.
  • TroganTrogan London, UK
    edited May 2007
    Hi dodomn,

    Baabiouz wants you to use AVG Anti-Spyware. You can download that from here. Once downloaded, follow Baabiouz's above instructions. AVG Anti-Spyware is a different program to AVG Anti-Virus.

    Sorry to jump in, Baabiouz! :)
  • dodomn
    edited May 2007
    Alright, that makes sense, thanks a lot for clearing that up. Here are the logs:


    Logfile of HijackThis v1.99.1
    Scan saved at 2:59:07 PM, on 5/27/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Documents and Settings\eric\Desktop\utorrent.exe
    C:\Program Files\Trillian\trillian.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Startup: Shortcut to utorrent.lnk = C:\Documents and Settings\eric\Desktop\utorrent.exe
    O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

    AVG Anti-Spyware - Scan Report

    + Created at: 2:38:09 PM 5/27/2007

    + Scan result:



    HKLM\SOFTWARE\Classes\Wallpaper.WallpaperManager -> Adware.HotBar : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\Wallpaper.WallpaperManager.1 -> Adware.HotBar : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\Wallpaper.WallpaperManager\CLSID -> Adware.HotBar : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\Wallpaper.WallpaperManager\CurVer -> Adware.HotBar : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015201.exe -> Downloader.Agent.bfw : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015232.exe -> Downloader.Agent.bfw : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015113.exe -> Downloader.Alphabet.b : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015247.exe -> Downloader.Alphabet.b : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015254.exe -> Downloader.Alphabet.b : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015233.exe -> Downloader.Small.cpg : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015118.exe -> Downloader.VB.att : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015132.exe -> Downloader.VB.att : Cleaned with backup (quarantined).
    C:\QooBox\Quarantine\C\WINDOWS\system32\klikalka.exe.vir -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP58\A0013786.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP58\A0013950.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP58\A0015014.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015088.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015126.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015226.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015304.exe -> Hijacker.Small.mv : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C82EE001-0743-459B-8923-706F382842E6}\RP59\A0015191.exe -> Hijacker.Tiny.h : Cleaned with backup (quarantined).



    Thanks again!
  • Baabiouz
    edited May 2007
    Thanks Trogan!

    Dodomn:

    Looking over your log, it seems you don't have any evidence of a third party firewall.

    As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

    1) ZoneAlarm
    2) Agnitum
    3) Sunbelt/Kerio
    4) Comodo

    If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.


    After you have installed Firewall,your log looks ok, do you have problems?
  • dodomn
    edited May 2007
    No, i don't. Thank you very much, i really appreciate it! :)
  • Baabiouz
    edited May 2007
    Log looks clean...great job!

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.
    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    Glad I was able to help.
  • dodomn
    edited May 2007
    Alright, all done. Thanks again, who knows what that stupid thing would have done.
This discussion has been closed.