Options

Multiple Popups and advertisement attacks.

Unknown
edited January 2008 in Spyware & Virus Removal
Hello!
Well, Im back again with some serious issue here, possible trojan infection and trouble with the PC speed.
HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 08:59:14 p.m., on 22/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\wscrntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\crss.exe
C:\Documents and Settings\Psy\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\wscrntfy.exe -runservice
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [unsrvc] C:\WINDOWS\system32\wscrntfy.exe -runservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Curb tool help dart] C:\Documents and Settings\All Users\Application Data\Move Bore Curb Tool\16 Ooze.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WinZix Service] C:\Program Files\WinZix\wakeservice.exe
O4 - HKCU\..\Run: [tons byte] C:\DOCUME~1\Psy\APPLIC~1\THIRDA~1\Creative proc.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1198869902515
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

I have made an online scan with Karpersky and it prompts me 2 trojans, but I will stick first with the HJT log.. ;)
Thx!

Comments

  • TrojanHater
    edited January 2008
    Bump. :D
  • TroganTrogan London, UK
    edited January 2008
    Hi,

    Some files I would like scanned:
    • Go to VirusTotal
    • Copy and paste the following file path into the Search Box in the middle of the page:
      • C:\WINDOWS\system32\crss.exe
    • Now, click on the Send File button
    • When the results are displayed, make a copy of them. Post the results in your next reply.
    Do the same for the following files...

    C:\WINDOWS\system32\wscrntfy.exe
  • TrojanHater
    edited January 2008
    Hi, thx for the reply, here is the report for the crss.exe file:

    Motor antivirus Versión Última actualización Resultado AhnLab-V3 2008.1.16.10 2008.01.15 - AntiVir 7.6.0.48 2008.01.15 HEUR/Malware Authentium 4.93.8 2008.01.13 - Avast 4.7.1098.0 2008.01.14 - AVG 7.5.0.516 2008.01.14 Generic9.ALFR BitDefender 7.2 2008.01.15 - CAT-QuickHeal 9.00 2008.01.15 - ClamAV 0.91.2 2008.01.14 - DrWeb 4.44.0.09170 2008.01.15 modification of BackDoor.Generic.981 eSafe 7.0.15.0 2008.01.14 - eTrust-Vet 31.3.5459 2008.01.15 - Ewido 4.0 2008.01.15 - FileAdvisor 1 2008.01.15 - Fortinet 3.14.0.0 2008.01.15 PWS.A!tr F-Prot 4.4.2.54 2008.01.14 - F-Secure 6.70.13030.0 2008.01.15 - Ikarus T3.1.1.20 2008.01.15 - Kaspersky 7.0.0.125 2008.01.15 - McAfee 5208 2008.01.15 Generic PWS.a Microsoft 1.3109 2008.01.15 - NOD32v2 2793 2008.01.15 probably unknown NewHeur_PE virus Norman 5.80.02 2008.01.15 - Panda 9.0.0.4 2008.01.14 Trj/LdPinch.APK Prevx1 V2 2008.01.15 Heuristic: Suspicious File With Covert Attributes Rising 20.27.12.00 2008.01.15 - Sophos 4.24.0 2008.01.15 - Sunbelt 2.2.907.0 2008.01.15 - Symantec 10 2008.01.15 - TheHacker 6.2.9.187 2008.01.13 - VBA32 3.12.2.5 2008.01.13 - VirusBuster 4.3.26:9 2008.01.15 - Webwasher-Gateway 6.6.2 2008.01.15 Heuristic.Malware Información adicional File size: 45058 bytes MD5: cfa51e304cbd5d0dbc0db126f3cdb255 SHA1: 52d51fcc3deb843b3d1fd79950bb1e481d70c920 PEiD: - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=6EFF960302C89420B02300E75C463000D3E5C47E
    And the one for the wscrntfy.exe file:

    Motor antivirus Versión Última actualización Resultado AhnLab-V3 2008.1.23.10 2008.01.22 - AntiVir 7.6.0.48 2008.01.22 - Authentium 4.93.8 2008.01.22 - Avast 4.7.1098.0 2008.01.22 Win32:VB-GNY AVG 7.5.0.516 2008.01.22 VB.BZU BitDefender 7.2 2008.01.22 - CAT-QuickHeal 9.00 2008.01.22 TrojanDownloader.VB.cbz ClamAV 0.91.2 2008.01.22 Trojan.Downloader-20103 DrWeb 4.44.0.09170 2008.01.22 BackDoor.Generic.1629 eSafe 7.0.15.0 2008.01.16 - eTrust-Vet 31.3.5477 2008.01.22 - Ewido 4.0 2008.01.22 - FileAdvisor 1 2008.01.22 High threat detected Fortinet 3.14.0.0 2008.01.22 W32/VB.CBZ!tr.dldr F-Prot 4.4.2.54 2008.01.21 W32/Downldr2.AXHA F-Secure 6.70.13260.0 2008.01.22 Trojan-Downloader.Win32.VB.cbz Ikarus T3.1.1.20 2008.01.22 Trojan-Downloader.Win32.VB.cbz Kaspersky 7.0.0.125 2008.01.22 Trojan-Downloader.Win32.VB.cbz McAfee 5212 2008.01.21 Generic PWS.o Microsoft 1.3109 2008.01.22 Worm:Win32/Spetcrum.B NOD32v2 2815 2008.01.22 Win32/VB.NKM Norman 5.80.02 2008.01.21 W32/DLoader.dam Panda 9.0.0.4 2008.01.21 Trj/Agent.HFM Prevx1 V2 2008.01.22 - Rising 20.28.12.00 2008.01.22 - Sophos 4.24.0 2008.01.22 Mal/Banker-A Sunbelt 2.2.907.0 2008.01.17 - Symantec 10 2008.01.22 Downloader TheHacker 6.2.9.194 2008.01.22 Trojan/Downloader.VB.cbz VBA32 3.12.2.5 2008.01.21 Trojan-Downloader.Win32.VB.cbz VirusBuster 4.3.26:9 2008.01.22 - Webwasher-Gateway 6.6.2 2008.01.22 - Información adicional Tamano archivo: 315392 bytes MD5: db5fac56693476e750b589fb1907c488 SHA1: d80e134ed031d3ed254b5bb556150ea746ea76a4 PEiD: - Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=db5fac56693476e750b589fb1907c488
    Dont really know what does this means...hope you will. ;) I will attach the reports as well since I see it a bit scrambled here..
    Thx!
  • TroganTrogan London, UK
    edited January 2008
    Hi TrojanHater,

    Before we begin, I need you to disable Spybots TeaTimer as it will interfere with the fix.
    • Open Spybot Search & Destroy
    • Go to the Mode menu, and make sure "Advanced Mode" is selected
    • On the left hand side, choose Tools -> Resident
    • Uncheck "Resident TeaTimer" and OK any prompts
    • Exit SpyBot

    Please do the following...

    1. I don't see any indication of a Firewall in your HijackThis log. This may be because:

    (1.) You are using Windows Firewall or a hardware Firewall.
    (2.) You are using a Firewall of an unknown vendor.
    (3.) You are using a Firewall, but it is disabled for unknown reasons
    (4.) You don't use any firewall at all.

    In the case you don't have a Firewall, please download one from the list below - They are Free!

    Comodo
    Zone Alarm
    Sunbelt Kerio PF
    Outpost Firewall

    Likewise, I don't see an indication of an Anti-Virus in your HijackThis log. Download one from the list below - They are Free!

    AntiVir
    AVG Free Edition
    avast! 4 Home Edition

    2. Open Task Manager (Ctrl+Alt+Del)
    • Click Processes tab
    • Find crss.exe and select End Process. Do NOT confuse this with the legit csrss.exe
    • Close Task Manager
    3. Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\wscrntfy.exe -runservice

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O4 - HKLM\..\Run: [unsrvc] C:\WINDOWS\system32\wscrntfy.exe -runservice

    - Close ALL open windows (especially Internet Explorer!)
    - Click Fix Checked
    Close HiajckThis

    4. Run HijackThis and click on Open the Misc Tools section.
    Click on delete a file on reboot...
    Copy and paste the following into the "File name:" text box and then click Open:

    C:\WINDOWS\system32\wscrntfy.exe

    When you are asked "Do you want to restart your computer now?", click NO.
    Repeat these steps for the following file(s) and this time, when you reach the end, click OK:

    C:\WINDOWS\system32\crss.exe

    Your PC MUST reboot to delete the files!

    5. Please post a new HijackThis log.
  • TrojanHater
    edited January 2008
    Hi Trogan, thx for your reply.
    First of all, I must tell you that im stucked on step 2 since I cant remove that process from the task manager. I thought that I should not fix with HJT since I havent erased the process and its still there running, it just stand there after I confirm Windows to delete the .exe file. Weird? I dont know, you tell me.
    Another question, after I make all the HJT stuff, should I turn ON the TeaTimer again on the Search&Destroy software?
    Salutacions!

    About the firewall and antivirus program, yes, ofcourse im aware of that, but since I recently reboot my pc... And now this damn trojan messing my clean system, Im really pissed.. thx for your help. ;)
  • TroganTrogan London, UK
    edited January 2008
    Don't worry about step 2. Do what you can and then post a new HijackThis log.
  • TrojanHater
    edited January 2008
    Ahhhhh!!!!!:confused:
    Im goin mad, I cant enter Windows when I type in my welcome password on startup after the reboot..what happened???? I did everything you told me..
    Any chances to fix this??? :sad2:



    I tried to enter on safe mode and safe mode with network but I still cant get in into Windows! Im really worried! I dont really want another system restore...
  • TrojanHater
    edited January 2008
    After trying a repair with the recovery disc all was set to restart and on reboot the repair screen came again and again, even if doing the repair process once more..with or without the disc, it was really scary the whole deal.:confused:
    It sucked big time really, now I had to shredder my HD with a full system restore..obviously now it works.
    Im damn pissed..no cheers for now and no Manchester United relly!! :mad2:
    I loosed my free new brand Office2007 and all life photos..:sad2:
    Really bad now..sorry to paste this but I was like I need to explode somewhere..:rolleyes2
    Salutacions...
  • TroganTrogan London, UK
    edited January 2008
    We didn't fix anything that would have caused this problem, so I don't know what happened. :confused:

    I do apologise for the problems caused. :(
Sign In or Register to comment.