mar1972
2006-05-08, 20:06
Hi there,
I had a malware issue and I ran Spybot, which allowed me to fix most of the issues. However, I wasn't able to delete the Command Service file until I ran Spybot in safe mode. Now the Command Service file seems to be permanently gone, but traces, tracking cookies and pop-ups still appear after I reboot. These can be deleted easily using Spybot - but they reappear again the next time I restart - so I don't think I've nipped the problem at the source. Is there more I need to do?
Thanks
Here is my hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 1:45:25 PM, on 5/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Nhksrv.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINNT\System32\NALNTSRV.EXE
C:\WINNT\System32\wm.exe
C:\WINNT\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\System32\CCM\CcmExec.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\NOVELL\ZENRC\WUOLService.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINNT\System32\WMRUNDLL.EXE
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\dpmw32.exe
C:\WINNT\System32\NWTRAY.EXE
C:\WINNT\System32\hkcmd.exe
C:\WINNT\DELLMMKB.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\ufzz\ufzzm.exe
C:\PROGRA~1\COMMON~1\ufzz\ufzza.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Interwise\Student\pull.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\WINNT\msagent\AgentSvr.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.mercer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.mercer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cantime.mercer.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Mercer Human Resource Consulting
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://autoconfig.mercer.ca/ie5/caw2k/ie5.ins
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.mercer.ca:80;https=proxy.mercer.ca:80;gopher=proxy.mercer.ca:80;socks=
proxy.mercer.ca:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = mercersurvey.imercer.com;10.*;168.168.*;199.85.36.*;205.156.133.*;207.192.*;204.26.
1.*;www.mmcenterpriserisk.com;*mercermc.com;207.236.*;www.compliance.mmc.com;*.
mercer.com;secure001.uwatwork.com;*.mercer.ca;www.pensionweb.c;<local>
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINNT\DELLMMKB.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Register OCX] regsvr32.exe /s msdxm.ocx
O4 - HKCU\..\Run: [ufzz] C:\PROGRA~1\COMMON~1\ufzz\ufzzm.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Push Client.LNK = C:\Interwise\Student\pull.exe
O4 - Global Startup: startDriveMap.bat
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://intranet.mercer.com
O15 - Trusted Zone: http://*.mercer.ca
O15 - Trusted Zone: http://aboutpageproduction.mercer.com
O15 - Trusted Zone: http://home.mercer.com
O15 - Trusted Zone: http://intranet.mercer.com
O15 - Trusted Zone: http://intranetapp.mercer.com
O15 - Trusted Zone: http://mercerdesktop.mercer.com
O15 - Trusted Zone: http://mercerlink.mercer.com
O15 - Trusted Zone: http://ukc.mercerdesktop.mercer.com
O15 - Trusted Zone: http://ukl.mercerdesktop.mercer.com
O15 - Trusted Zone: http://*.mercer.com
O15 - Trusted Zone: http://*.whkg2aap01
O15 - Trusted Zone: http://*.wmel2aap01
O15 - Trusted Zone: http://*.mercer.ca (HKLM)
O15 - Trusted Zone: http://aboutpageproduction.mercer.com (HKLM)
O15 - Trusted Zone: http://home.mercer.com (HKLM)
O15 - Trusted Zone: http://intranet.mercer.com (HKLM)
O15 - Trusted Zone: http://intranetapp.mercer.com (HKLM)
O15 - Trusted Zone: http://mercerdesktop.mercer.com (HKLM)
O15 - Trusted Zone: http://mercerlink.mercer.com (HKLM)
O15 - Trusted Zone: http://ukc.mercerdesktop.mercer.com (HKLM)
O15 - Trusted Zone: http://ukl.mercerdesktop.mercer.com (HKLM)
O15 - Trusted Zone: http://*.mercer.com (HKLM)
O15 - Trusted Zone: http://*.whkg2aap01 (HKLM)
O15 - Trusted Zone: http://*.wmel2aap01 (HKLM)
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {a2001dd0-c7bd-11d4-a3e1-00c04fa32518} -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mercer.com
O17 - HKLM\Software\..\Telephony: DomainName = mercer.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mercer.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mercer.com,mercer.ca,mercerz.ca
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mercer.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mercer.com,mercer.ca,mercerz.ca
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mercer.com,mercer.ca,mercerz.ca
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINNT\System32\NALNTSRV.EXE
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINNT\Nhksrv.exe
O23 - Service: Remote management (Novell WUser Agent) - Novell, Inc. - C:\NOVELL\ZENRC\wuser32.exe
O23 - Service: Aelita DMW Migration Agent (Vmover.exe) - Aelita Software Corporation - C:\WINNT\System32\Vmover.exe
O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINNT\System32\wm.exe
O23 - Service: WUOLservice (WUOLService) - Novell, Inc. - C:\NOVELL\ZENRC\WUOLService.exe
I had a malware issue and I ran Spybot, which allowed me to fix most of the issues. However, I wasn't able to delete the Command Service file until I ran Spybot in safe mode. Now the Command Service file seems to be permanently gone, but traces, tracking cookies and pop-ups still appear after I reboot. These can be deleted easily using Spybot - but they reappear again the next time I restart - so I don't think I've nipped the problem at the source. Is there more I need to do?
Thanks
Here is my hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 1:45:25 PM, on 5/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Nhksrv.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINNT\System32\NALNTSRV.EXE
C:\WINNT\System32\wm.exe
C:\WINNT\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\System32\CCM\CcmExec.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\NOVELL\ZENRC\WUOLService.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINNT\System32\WMRUNDLL.EXE
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\dpmw32.exe
C:\WINNT\System32\NWTRAY.EXE
C:\WINNT\System32\hkcmd.exe
C:\WINNT\DELLMMKB.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\ufzz\ufzzm.exe
C:\PROGRA~1\COMMON~1\ufzz\ufzza.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Interwise\Student\pull.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\WINNT\msagent\AgentSvr.exe
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.mercer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.mercer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cantime.mercer.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Mercer Human Resource Consulting
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://autoconfig.mercer.ca/ie5/caw2k/ie5.ins
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.mercer.ca:80;https=proxy.mercer.ca:80;gopher=proxy.mercer.ca:80;socks=
proxy.mercer.ca:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = mercersurvey.imercer.com;10.*;168.168.*;199.85.36.*;205.156.133.*;207.192.*;204.26.
1.*;www.mmcenterpriserisk.com;*mercermc.com;207.236.*;www.compliance.mmc.com;*.
mercer.com;secure001.uwatwork.com;*.mercer.ca;www.pensionweb.c;<local>
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINNT\DELLMMKB.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Register OCX] regsvr32.exe /s msdxm.ocx
O4 - HKCU\..\Run: [ufzz] C:\PROGRA~1\COMMON~1\ufzz\ufzzm.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Push Client.LNK = C:\Interwise\Student\pull.exe
O4 - Global Startup: startDriveMap.bat
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://intranet.mercer.com
O15 - Trusted Zone: http://*.mercer.ca
O15 - Trusted Zone: http://aboutpageproduction.mercer.com
O15 - Trusted Zone: http://home.mercer.com
O15 - Trusted Zone: http://intranet.mercer.com
O15 - Trusted Zone: http://intranetapp.mercer.com
O15 - Trusted Zone: http://mercerdesktop.mercer.com
O15 - Trusted Zone: http://mercerlink.mercer.com
O15 - Trusted Zone: http://ukc.mercerdesktop.mercer.com
O15 - Trusted Zone: http://ukl.mercerdesktop.mercer.com
O15 - Trusted Zone: http://*.mercer.com
O15 - Trusted Zone: http://*.whkg2aap01
O15 - Trusted Zone: http://*.wmel2aap01
O15 - Trusted Zone: http://*.mercer.ca (HKLM)
O15 - Trusted Zone: http://aboutpageproduction.mercer.com (HKLM)
O15 - Trusted Zone: http://home.mercer.com (HKLM)
O15 - Trusted Zone: http://intranet.mercer.com (HKLM)
O15 - Trusted Zone: http://intranetapp.mercer.com (HKLM)
O15 - Trusted Zone: http://mercerdesktop.mercer.com (HKLM)
O15 - Trusted Zone: http://mercerlink.mercer.com (HKLM)
O15 - Trusted Zone: http://ukc.mercerdesktop.mercer.com (HKLM)
O15 - Trusted Zone: http://ukl.mercerdesktop.mercer.com (HKLM)
O15 - Trusted Zone: http://*.mercer.com (HKLM)
O15 - Trusted Zone: http://*.whkg2aap01 (HKLM)
O15 - Trusted Zone: http://*.wmel2aap01 (HKLM)
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {a2001dd0-c7bd-11d4-a3e1-00c04fa32518} -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mercer.com
O17 - HKLM\Software\..\Telephony: DomainName = mercer.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mercer.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mercer.com,mercer.ca,mercerz.ca
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mercer.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = mercer.com,mercer.ca,mercerz.ca
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mercer.com,mercer.ca,mercerz.ca
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINNT\System32\NALNTSRV.EXE
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINNT\Nhksrv.exe
O23 - Service: Remote management (Novell WUser Agent) - Novell, Inc. - C:\NOVELL\ZENRC\wuser32.exe
O23 - Service: Aelita DMW Migration Agent (Vmover.exe) - Aelita Software Corporation - C:\WINNT\System32\Vmover.exe
O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINNT\System32\wm.exe
O23 - Service: WUOLservice (WUOLService) - Novell, Inc. - C:\NOVELL\ZENRC\WUOLService.exe