View Full Version : System32 Folder is Inaccessible; Can't Boot Normal Mode
While searching Google for information to solve my PC infection, I came across user Vexta's thread entitled "Cannot access System32 folder." I have the same problem, but perhaps worse. Please help.
I have Windows 2000 Professional [i.e. Windoes 2000 SP4 (WinNT 5.00.2195)] running IE v6.00 SP1 (6.00.2800.1106). On Thursday night, December 14, my system slowed dramatically and some DOS windows popped up running BAT files that I certainly didn't execute myself. I tried hit Ctrl-Alt-Del to run Task Manager, but that button was suddenly grayed out. I could not Close any of the windows that opened on my screen. From that point forward, when I attempt to reboot my PC, it simply goes into a reboot loop--only getting as far as the blue screen that follows the Windows 2000 Professional "splash screen."
In other words, I cannot successfully boot in Normal Mode.
I can boot into Safe Mode, but can't successfully run networking. (I am posting this from my wife's laptop.)
If I run Windows Explorer and attempt to open the WINDOWS/System32 folder, my system crashes. If I run a Full System Scan with Norton Antivirus 2006, my system crashes. I tried running F-Prot /inter, and it froze everytime after scanning a few DLLs.
All of my .DBX files (Microsoft Outlook folders) got an updated modified date.
I read some other threads and tried some of the advice given there. For example, I copied Fixwareout to the PC and ran its Fixit bat file in Safe Mode. Unlike user Vexta, this did NOT permit me to access my System/32 folder. Fixwareout's report.txt file (I am rekeying this, since I cannot actually post anything from my PC):
---- start ----
Fixwareout
Last edited 12/06/2006
Post this report in the forums please
...
Prerun check
[HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
...
...
Reg Entries that were deleted
...
Random Runs removed from HKLM
...
...
PLEASE NOTE, There will be LEGITIMATE FILES LISTED (etc.)
>> >> >> >> >> Searching by size/names...
>> >> >> >> >>
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects.
>> >> >> >> >> Misc. files.
C:\WINDOWS\System32\adir.dll
>> >> >> >> >> Checking for older varients civered by the Rem3 tool.
...
Postrun check
[HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
...
---- end ----
I also copied HiJackThis to my infected PC and ran it in Safe Mode. Again, I am hand-keying this in, so hopefully I'm not introducing any typos. Please note that I deleted ieredir.exe, dsrss.exe, (and several other dodgy looking files that appeared on my desktop), and the C:\WINDOWS\inet20000 folder that appeared during Thursday night's infection. "rock.exe" in HKLM looks suspicious to me. Please also note that I would like to get rid of all the Earthlink stuff (old girlfriend installed that junk years ago):
---- start ----
Logfile of HijackThis v1.99.1
Scan saved at 8:58:43 AM, on 12/17/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\System32\services.exe
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\NOTEPAD.EXE
C:\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.findthewebsiteyouneed.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Earthlink
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\svcinit.exe
O2 - BHO: AcroIEHlprobj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\WINDOWS\inet20000\1215152430.dll (file missing)
O2 - BHO: ib6.CBrowserHelper - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - C:\WINDOWS\system32\ib15.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6mons.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Antivirus\NavShExt.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\System32\nzdd0.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Antivirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700 NT\bin\ktchnsnk.exe" -reg "Software\Hewlet--Packard\OfficeJet Series 700\Install"
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\Earthlink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\Earthlink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGR~1\INSTAN~1\INSTAN~1\IWCTL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [rock] rock.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20000\services.exe
O4 - HKLM\..\Run: [SvcManager] mdmex7.exe
O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [WinSysModule] dsrss.exe
O4 - HKLM\..\Run: [IE Redir] C:\WINDOWS\ieredir.exe
O4 - HKLM\..\Run: [Microsoft WPCEmail] C:\WINDOWS\inet20000\svchost.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: RealDownload.lnk = C:\Program Files\REAL\RealDownload\Realdownload.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC2.EXE
O4 - Global Startup: HPAioDevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://C:\counter.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O17 - HKLM\System\CS1\Services\Tcpop\Parameters: gtfc.com,gtservicing.com
O17 - HKLM\System\CS2\Services\Tcpop\Parameters: gtfc.com,gtservicing.com
O17 - HKLM\System\CSS\Services\Tcpop\Parameters: gtfc.com,gtservicing.com
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINDOWS\system32\baagf32.dll (file missing)
O21 - SSODL: LIJKE - {07CE0A0D-AD64-A0A7-9BB6-58AA4D7D07D8} - C:\WINDOWS\system32\jhuiq.dll (file missing)
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi149112.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft Authenticate Service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe
O23 - Service: Norton Antivirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton Antivirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Coporation - C:\Program Files\Common Files\Symantect Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Antivirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Coporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk Service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantect Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Pgroam Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
---- end ----
Please keep in mind that my infect PC is not able to boot in Normal Mode and cannot boot up in Safe Mode with Networking :^(
Thanks in advance for your help!
Hi Puffy and welcome to Safer Networking Forums :)
Your computer is heavily infected :sad:
One or more of the identified infections is a backdoor trojan :sick:
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? (http://www.dslreports.com/faq/10451)
When Should I Format, How Should I Reinstall (http://www.dslreports.com/faq/10063)
However, if you do not have the resources to reinstall your computer and would like me to attempt to clean it, I will be happy to do so.
Should you have any questions, please feel free to ask.
Please let us know what you have decided to do in your next post.
Thanks, Mr_JAk3,
What I'd like to do is first save off some files that are of value to me like Quicken data), then try fixing the PC with the OS installation that's currently there. If that fails, then I'll reformat and reinstall.
Regarding saving of files, can I trust my Microsoft Outlook .DBX files anymore? They clearly got timestamped within minutes of my PC's infection. Could the DBX files themselves be infected? I obvisouly don't want to copy those files to another PC (or back onto the same PC, once it's cured) if that will simply propagate the virus.
Another question: I have a second hard-disk installed as my F: drive. Since this is not my boot drive, should I be concerned about there being infected files on that second disk? It's got stuff like family photos and my doctoral research files--no applications or other executables--which I'd like to preserve.
Most of the software on my C: drive I can reinstall, so I'm not too concerned about the contents of that disk (other than my DBX files, that is), if I must reformat my C: drive.
So, what steps can I take to begin trying to fix my PC with the current OS...?
P
Hi :)
Backups should be done before somtehing bad happens. The is always a risk that you move infections from one place to another. Pictures, textfiles and music should be good to go. Don't take eg any exe or dll files.
If you think that outlook files are infected, don't backup those.
The F-drive may be infected too.
So you have another computer that you can use during the cleaning right ?
We need some tool and you need to move those to the infected computer with eg a memory stick or a cd. Also copy the logs that way. You can't write them all.
Download SDFix (http://downloads.andymanchesta.com/RemovalTools/SDFix.zip) and save it to your desktop.
Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
In Safe Mode, right click the SDFix.zip folder and choose Extract All,
Open the extracted folder and double click RunThis.bat to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log
Thanks again, MR_JAk3.
I'll try these steps tonight, when I'm back home. In the meantime, I have a question about your instrux: After I run the RunThis.BAT fix, am I to let the PC try to boot normally, or do I take it back into Safe Mode?
Thanks,
P
Hi :)
You can try if it runs in normal mode.
Ok, Mr_JAk3...
I downloaded SDFix, copied it over to the infected PC's desktop, extracted it, then ran the RunThis.BAT file. It seemed to run ok, with the exception of one error message (which I saw when I ran other BAT files):
C:\WINDOWS\SETVER.EXECannot load VDM IPX/SPX Support
(I googled this and found lots of hits--it didn't *appear* to be a major problem, but I ain't the PC expert here...)
When the PC attempted to reboot, I skipped the F8 and let it go normal. It went into its now-all-too-familiar reboot loop. I powered off, powered on, and booted back into Safe Mode. Here is the resulting Report.TXT file (sadly, I must re-key this because my 7 year-old PC has a read-only CD drive):
---- start ----
SDFix Version 1.49
************
Mon 12/18/2006 - 19:03:17.84
Microsoft Windows 2000 [Version 5.00.2195]
Running From: C:\DOCUME~1\ADMINI~1\Desktop\SDFix\SDFix
Stage One - Safe Mode
Checking Services...
Service Name:
aspi113210
ICF
MsaSvc
File Path:
C:\WINDOWS\System32\aspi149112.exe
C:\WINDOWS\System32\icf.exe
C:\WINDOWS\System32\msasvc.exe
aspi113210 Deleted...
ICF Deleted...
MsaSvc Deleted...
Starting Registry Repairs...
Restoring Default Hosts File...
Stage One Complete
Rebooting...
---- end ----
Here's the subsequent HJT log:
---- start ----
Logfile of HijackThis v1.99.1
Scan saved at 7:14:19 PM, on 12/18/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\System32\services.exe
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.findthewebsiteyouneed.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/mor...on/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Earthlink
O2 - BHO: AcroIEHlprobj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Antivirus\NavShExt.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\System32\nzdd0.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Antivirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700 NT\bin\ktchnsnk.exe" -reg "Software\Hewlet--Packard\OfficeJet Series 700\Install"
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\Earthlink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\Earthlink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGR~1\INSTAN~1\INSTAN~1\IWCTL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [rock] rock.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [WinSysModule] dsrss.exe
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMIN~1\DESKTOP\SDFIX\SDFIX\RUNTHIS.BAT /second
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: RealDownload.lnk = C:\Program Files\REAL\RealDownload\Realdownload.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC2.EXE
O4 - Global Startup: HPAioDevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://C:\counter.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www-secure.symantec.com/techs...l/LSSupCtl.cab
O17 - HKLM\System\CS1\Services\Tcpop\Parameters: SearvhList = gtfc.com,gtservicing.com
O17 - HKLM\System\CS2\Services\Tcpop\Parameters: SearvhList = gtfc.com,gtservicing.com
O17 - HKLM\System\CSS\Services\Tcpop\Parameters: SearvhList = gtfc.com,gtservicing.com
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINDOWS\system32\baagf32.dll (file missing)
O21 - SSODL: LIJKE - {07CE0A0D-AD64-A0A7-9BB6-58AA4D7D07D8} - C:\WINDOWS\system32\jhuiq.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmina) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft Authenticate Service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe
O23 - Service: Norton Antivirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton Antivirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Coporation - C:\Program Files\Common Files\Symantect Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Antivirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Coporation - C:\Program Files\Cacommon Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk Service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantect Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Pgroam Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
---- end ----
That *$^% SASSER worm is still there! Now what?
P
Additional info...
I can now access my System32 folder without crashing my PC! Wahoo!
Eagerly and gratefully awaiting your next instrux...
P
Hi again, we'll continue :)
Please read these instrucitions through since there are a few tool that you need to download and move to the infected computer.
You should print these instructions or save these to a text file. Follow these instructions carefully.
Please download AVG Anti-Spyware and move it to the infected computers desktop.
http://www.ewido.net/en/download/
Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
Click on Change state next to Resident shield. It should now change to inactive.
Click on Change state next to Automatic updates. It should now change to inactive.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
IUse this link to manually update AVG.
AVG Anti-Spyware manual updates (http://www.ewido.net/en/download/updates/).
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
Do NOT run yet.
Make your hidden files visible:
Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.
==================
Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.findthewebsiteyouneed.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\System32\nzdd0.dll
O4 - HKLM\..\Run: [rock] rock.exe
O4 - HKLM\..\Run: [WinSysModule] dsrss.exe
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMIN~1\DESKTOP\SDFIX\SDFIX\RUNTHIS.BAT /second
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://C:\counter.cab
O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINDOWS\system32\baagf32.dll (file missing)
O21 - SSODL: LIJKE - {07CE0A0D-AD64-A0A7-9BB6-58AA4D7D07D8} - C:\WINDOWS\system32\jhuiq.dll (file missing)
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Microsoft Authenticate Service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe
Open Notepad and copy the following lines into a new document:
@echo off
sc stop ICF
sc delete ICF
sc stop MsaSvc
sc delete MsaSvc
Save the document to your desktop as Remove.bat and filetype: All Files
Go to your desktop and run the file Remove.bat and allow to run it if prompted. A window will open and close.
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\System32\nzdd0.dll
C:\counter.cab
C:\WINDOWS\system32\icf.exe
C:\WINDOWS\System32\msasvc.exe
C:\WINDOWS\system32\jhuiq.dl
Use the Windows search Start
Search
All files and folders
More advanced options Checkmark these options: "Search system folders"
"Search hidden files and folders"
"Search subfolders"
Search for this and delete if found: rock.exe
Search for this and delete if found: dsrss.exe
Run ATF Cleaner Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act?
Click on Recommended Action and choose Quarantine from the popup menu.
Under How to scan?
All checkboxes should be ticked.
Under Possibly unwanted software:
All checkboxes should be ticked.
Under Reports:
Select Automatically generate report after every scan and uncheck Only if threats were found.
Under What to scan?
Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
When done, click the Save Scan Report button. (4)
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
Try if the PC runs in normal mode.
================
When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
Mr_JAk3,
Thank you for the very clear instrux. I will apply them this evening.
Just FYI, I ran a full system scan with Norton Antivirus (in Safe Mode) last night to see whether 1) it would run now that System32 is accessible, and 2) whether it would find any nasties. It ran to completion, checking both my C: and F: drives, but found only one measly adware turd of low risk. Is NAV simply crap, or did the nasties somehow disable it? I know NAV has limited capability in Safe Mode, but shouldn't it be able to find the executables that I myself can see in System32? There are about 20 dodgy looking executables files in my System32 folder which are datestamped within minutes of each other from the night my PC was molested. Some of them--like LSASS.EXE--are clearly unwelcome intruders. Why doesn't NAV see them?
Thanks again. More tonight...
P
Hi :)
Are you sure that your NAV is up-to-date ?
No Antivirus is 100% efective, you get best results by using multiple scanners.
Please note that there is also a a legitimate system file named LSASS.EXE
:bigthumb:
:oops: My bad. I had seen a new file named LSASS that appeared on my desktop during Thursday night's attack on my PC. I deleted that file, then assumed anything named LSASS was bad. I wikied LSASS and am now slightly more knowledgeable about Microsoft's Local Security Authority Subsystem Service. :)
More later, after tonight's next fix operations...
P
Per your other point, My NAV defs are a little out of date. For the past few months, the LiveUpdate wizard has been freezing up. This happened with my previous version of NAV, so I upgraded to the current 2006 version. It worked for a while, then starting freezing up again. Symantec Tech Support was not helpful in solving my problem, so I essentially gave up on it. :sad:
P
Mr_JAk3,
I ran your instructions very carefully. The only places where the instructions diverged from what I saw on my screen were perhaps due to differences across Windows versions(?) For example, Under My Computer -> Tools -> Folder Options -> View, I don't see a "Display the contents of system folders" option.
There was one small glitch when I attempted to run AVG for the full scan. When I clicked on the Scanner icon in the header, the app froze, then popped up a dialog box saying that something "bad" happened. I ran the app again and it appeared to work.
Other than that, everything went smoothly per your instrux. However, I still cannot reboot in Normal Mode. The PC crashes and goes into its reboot loop. :sad:
AVG found 176 infected objects, all on my C: drive. I am a bit too tired at this late hour to re-key the entire AVG report log. If you need it, I'll provide it later (perhaps after I purchase a RW drive for me ancient Dell!)
For now, here's the HJT log:
---- start ----
Logfile of HijackThis v1.99.1
Scan saved at 10:52:09 PM, on 12/19/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\System32\services.exe
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.EXE
C:\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/mor...on/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Earthlink
O2 - BHO: AcroIEHlprobj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Antivirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700 NT\bin\ktchnsnk.exe" -reg "Software\Hewlet--Packard\OfficeJet Series 700\Install"
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\Earthlink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\Earthlink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGR~1\INSTAN~1\INSTAN~1\IWCTL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\ADMIN~1\DESKTOP\SDFIX\SDFIX\RUNTHIS.BAT /second
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: RealDownload.lnk = C:\Program Files\REAL\RealDownload\Realdownload.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC2.EXE
O4 - Global Startup: HPAioDevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www-secure.symantec.com/techs...l/LSSupCtl.cab
O17 - HKLM\System\CS1\Services\Tcpop\Parameters: SearvhList = gtfc.com,gtservicing.com
O17 - HKLM\System\CS2\Services\Tcpop\Parameters: SearvhList = gtfc.com,gtservicing.com
O17 - HKLM\System\CSS\Services\Tcpop\Parameters: SearvhList = gtfc.com,gtservicing.com
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
023 - Service: AVG Anti-Spyware Guard - Anti Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti=Spayware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmina) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Antivirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton Antivirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Coporation - C:\Program Files\Common Files\Symantect Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Antivirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Coporation - C:\Program Files\Cacommon Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk Service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantect Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Pgroam Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
---- end ----
Given that I still cannot boot in Normal Mode, is there anything else that can be done to cure my PC? I'm happy to keep trying, as long as you have ideas...
Thanks again,
P
Hi :)
So it still doesn't run in norml mode :sad:
So you were able to move AVG-AntiSpyware to your infected computer ?
Why can't you transfer the AVG log to that same way back to the other computer ? We're going to need some other tools and logs so I think that re-typing ins't an option. Please let me know :bigthumb:
Mr_JAk3,
I don't have a CD-RW drive on my infected PC. It has a CD-ROM drive. I have been using my wife's laptop to download software from the Internet, burning it to CD, switching the CD from her laptop to my infected PC's CD-ROM drive, copying the files from CD to desktop.
Because my infected PC has a read-only CD drive, I can't go back the other way (i.e., burn a CD, switch it into my wife's laptop, cut-n-paste log to spybot.info).
Call me an idiot :rolleyes: but it just occurred to me--I should be able to use a memory stick to copy logs from my infected PC to the laptop without danger of also transporting malware, right? I've got a memory stick lying around somewhere. Or would it be more advisable to buy an external CD burner?
Another question: If I had been successful in booting up in Normal Mode last night, would I have been able to safely use networking? Or would my machine likely get nailed again, as soon as it got on the net? If I can get back on the net (either in Safe Mode or Normal Mode), it would sure simplify this process--but I don't want to complicate matters by allowing more nasties onto my box. Please advise. (BTW, I removed my wireless PCI card days ago, just to be safe.)
Thanks, as always, for all your help!
P
Hi :)
Ok if you have a memorystick I recommend that you use it. Just move the logs from the infected computer. It is impossible to rewrite all the huge logs.
Does your computer have a firewall (Norton ?)
Please post the AVG log to here (move it with the memorystick) and I'll have a look.
:bigthumb:
Thanks, Mr_JAk3. I'll post that AVG log tonight...
I don't recall whether I have a software firewall on my PC (as part of Norton). I am reasonably certain that I have a firewall in my router. I'll check both tonight...
[BTW, do you know where might I get information about defending against Joe Jobs? My domain name has been getting used heavily by a spammer(s) and I don't want it to become blacklisted as a spam site.]
Thanks,
P
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 10:38:24 PM 12/19/2006
+ Scan result:
C:\WINDOWS\Bbstore\DSS\DSSAGENT.EXE -> Adware.Background : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDEPLAYER.BDEPlayerCtrl -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDEPLAYER.BDEPlayerCtrl.1 -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDEPLAYER.BDEPlayerCtrl\CLSID -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDEPLAYER.BDEPlayerCtrl\CurVer -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDESmartInstaller25.BDESmartInstaller25 -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDESmartInstaller25.BDESmartInstaller25.1 -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BDESmartInstaller25.BDESmartInstaller25\CurVer -> Adware.BrilliantDigital : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Comet -> Adware.CometCursor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_503700.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_506000.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_507500.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_523000.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_530400.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_535100.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550600.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550601.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550602.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550603.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550700.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550701.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550702.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550703.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_550800.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_560800.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_565100.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_580300.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_585400.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_610000.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_621600.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_626800.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_672900.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_676000.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_737700.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_741200.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_744000.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_744100.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_761900.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_762200.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_773200.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_790200.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_792900.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_795000.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_795400.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_795500.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_798600.HTM -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_798700.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\AdCache\B_799600.GIF -> Adware.Cydoor : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Cydoor -> Adware.Cydoor : Cleaned with backup (quarantined).
HKLM\SOFTWARE\DownloadWare -> Adware.Downloadware : Cleaned with backup (quarantined).
HKLM\SOFTWARE\DownloadWare\Prefs -> Adware.Downloadware : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\WhenU -> Adware.SaveNow : Cleaned with backup (quarantined).
HKU\S-1-5-21-507921405-1078145449-1202660629-500\Software\TimeSink, Inc. -> Adware.TimeSink : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012089.dll -> Backdoor.Agent.fo : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012068.exe -> Downloader.Agent.bdb : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\z2806.exe -> Downloader.CWS.j : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012082.exe -> Downloader.Delf.aeu : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011834.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011858.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012070.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\FOUND.004\FILE0000.CHK -> Downloader.Small.awa : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011822.exe -> Downloader.Small.awa : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012065.exe -> Downloader.Small.awa : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011833.exe -> Downloader.Small.cib : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011835.exe -> Downloader.Small.cib : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011857.exe -> Downloader.Small.cib : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011881.exe -> Downloader.Small.cib : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\dlim.exe -> Downloader.Small.crc : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\gkfm.exe -> Downloader.Small.crc : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011821.exe -> Downloader.Small.crc : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012064.exe -> Downloader.Small.crc : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012309.exe -> Downloader.Small.ctf : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011892.EXE -> Downloader.Small.dam : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011895.EXE -> Downloader.Small.dam : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011896.exe -> Downloader.Small.dam : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012083.exe -> Downloader.Small.dam : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012085.EXE -> Downloader.Small.dam : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\glli.exe -> Downloader.Small.dex : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\mkli.exe -> Downloader.Small.dex : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012071.exe -> Downloader.Small.dex : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012086.exe -> Downloader.Small.dgk : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012092.EXE -> Downloader.Small.dgk : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012307.EXE -> Downloader.Small.ecm : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011953.exe -> Downloader.Tiny.bm : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\z2181685657847.exe -> Downloader.Vidlo.ao : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\z2181685672028.exe -> Downloader.Vidlo.ao : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012308.exe -> Dropper.Agent.azs : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011914.exe -> Dropper.Agent.ol : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\blie.exe -> Dropper.Delf.rc : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\dlnc.exe -> Dropper.Delf.rc : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011832.exe -> Dropper.Delf.va : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012069.exe -> Dropper.Delf.va : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\z2524.exe -> Dropper.Small.atd : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\3536.tmp -> Dropper.Small.aus : Cleaned with backup (quarantined).
C:\Program Files\Encompass\EncDial.exe -> Heuristic.Win32.Dialer : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011935.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011938.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011969.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011974.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012001.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012009.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012033.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012041.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012097.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012098.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012130.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012131.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012152.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012153.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012177.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012183.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012211.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012219.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012240.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012248.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012287.DLL -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012297.exe -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\3504.tmp -> Hijacker.Costrat.l : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\352E.tmp -> Hijacker.Costrat.l : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011845.sys -> Hijacker.Costrat.l : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\z2333.exe -> Hijacker.Costrat.t : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\install.exe -> Hijacker.Costrat.z : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\buxqzccm.exe -> Hijacker.Small.cc : Cleaned with backup (quarantined).
C:\Program Files\Norton AntiVirus\Savrt\0613NAV~.TMP -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011950.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011984.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012016.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012050.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012112.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012145.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012167.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012192.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012255.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012261.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012262.exe -> Logger.Agent.pr : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ipv6mons.dll -> Logger.BZub.gq : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\350B.tmp -> Logger.Small.ak : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\350F.tmp -> Logger.Small.ak : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\353A.tmp -> Logger.Small.ak : Cleaned with backup (quarantined).
C:\FOUND.005\FILE0000.CHK -> Logger.Small.ak : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ib15.dll -> Logger.VB.mz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011854.exe -> Not-A-Virus.Hoax.Win32.Renos.fk : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012076.exe -> Not-A-Virus.Hoax.Win32.Renos.fk : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012077.exe -> Not-A-Virus.Hoax.Win32.Renos.fk : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012078.dll -> Not-A-Virus.Hoax.Win32.Renos.fk : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012079.dll -> Not-A-Virus.Hoax.Win32.Renos.fk : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\KpdMHplhh -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\NmaHJmnfg -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\Odthe -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\QiqLNjchf -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012306.exe -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012081.dll -> Proxy.Agent.df : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012087.exe -> Proxy.Dlena.at : Cleaned with backup (quarantined).
C:\Program Files\Norton AntiVirus\Savrt\0158NAV~.TMP -> Trojan.Agent.ws : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012260.exe -> Trojan.Agent.ws : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012258.exe -> Trojan.Conycspa.i : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011920.EXE -> Trojan.Delf.xh : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011926.exe -> Trojan.Delf.xh : Cleaned with backup (quarantined).
C:\WINDOWS\smss.exe -> Trojan.Delf.xh : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\apihelp.chm -> Trojan.Dialer.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011831.exe -> Trojan.Dialer.hz : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sysfind.exe -> Trojan.Dialer.hz : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011894.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mdmex7.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll -> Trojan.Sinowal.bs : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012062.dll -> Trojan.Small.ev : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00012063.EXE -> Trojan.Small.ev : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011838.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011851.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011884.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\RECYCLED\NPROTECT\00011886.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\adir.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\cndi.exe -> Worm.Banwarum.j : Cleaned with backup (quarantined).
C:\Documents and Settings\pbroenen\Local Settings\Temp\knfk.exe -> Worm.Banwarum.j : Cleaned with backup (quarantined).
::Report end
Mr_JAk3,
My D-Link DI-624 router has a firewall. My HJT logs indicate that Norton is running a "Firewall Monitor":
O23 - Service: Norton Antivirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton Antivirus\IWP\NPFMntor.exe
What next?
P
Ok AVG Anti-Spy cleaned a nice amount of infections...
Can't you just ban the spammers ?
Here is a new scanner to run in safe mode, try if the computer runs in normal mode after this:
Download Dr.Web CureIt to the desktop -> ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Run a scan with Dr.Web CureIt Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, you should now mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found http://users.telenet.be/bluepatchy/miekiemoes/images/check.gif
If so, click it and then click the next icon right below and select Move incurable
After the scan, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot the computer in Normal Mode,
Post the Cure-it report and a fresh HijackThis log
:bigthumb:
Hei Mr_JAk3,
My PC still won't boot into Normal Mode. It crashes at the same point every time. :sad:
Logs to follow...
Any more ideas?
Thanks,
P
00011824.exe;C:\RECYCLED\NPROTECT;Trojan.MulDrop.4521;Deleted.;
00011825.exe;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00011883.EXE;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00011885.exe;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00011887.EXE;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012066.exe;C:\RECYCLED\NPROTECT;Trojan.MulDrop.4521;Deleted.;
00012067.exe;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012072.exe;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012073.exe;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012074.EXE;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012075.exe;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012080.EXE;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012084.EXE;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012088.exe;C:\RECYCLED\NPROTECT;Win32.HLLW.Recod;Deleted.;
00012090.EXE;C:\RECYCLED\NPROTECT;Trojan.DownLoader.15764;Deleted.;
00012257.EXE;C:\RECYCLED\NPROTECT;Trojan.Fakealert;Deleted.;
00012259.exe;C:\RECYCLED\NPROTECT;Trojan.Killer;Deleted.;
00012267.dll;C:\RECYCLED\NPROTECT;Trojan.PWS.Snap;Deleted.;
00012286.chm\DLLGeneral.html;C:\RECYCLED\NPROTECT\00012286.chm;Modification of BAT.Wed.4730;;
00012286.chm;C:\RECYCLED\NPROTECT;Archive contains infected objects;Moved.;
aspi1438212.exe;C:\WINDOWS\SYSTEM32;Trojan.Spambot;Deleted.;
aspi1454312.exe;C:\WINDOWS\SYSTEM32;Trojan.Spambot;Deleted.;
aspi149112.exe;C:\WINDOWS\SYSTEM32;Trojan.Spambot;Deleted.;
svchost.com;C:\Documents and Settings\pbroenen\Local Settings\Temp;Trojan.DownLoader.15198;Deleted.;
Process.exe;C:\Documents and Settings\Administrator\Desktop\SDFix\SDFix\apps;Tool.Prockill;Moved.;
Logfile of HijackThis v1.99.1
Scan saved at 9:37:20 PM, on 12/21/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.EXE
C:\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700 NT\bin\ktchnsnk.exe" -reg "Software\Hewlett-Packard\OfficeJet Series 700\Install"
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\ADMINI~1\DESKTOP\SDFIX\SDFIX\RUNTHIS.BAT /second
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: RealDownload.lnk = C:\Program Files\REAL\RealDownload\Realdownload.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gtfc.com,gtservicing.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gtfc.com,gtservicing.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gtfc.com,gtservicing.com
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
Hei Mr_JAk3,
My PC still won't boot into Normal Mode. It crashes at the same point every time. :sad:
P
Moi :D:
Ok that's bad news.
Let's see what we can find out....
1. Download this file - combofix.exe (http://download.bleepingcomputer.com/sUBs/combofix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Administrator - Fri 12/22/2006 18:22:10.80 Service Pack 4
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Administrator\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-11-22 to 2006-12-22 ))))))))))))))))))))))))))))))))))
2006-12-21 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\DoctorWeb
2006-12-19 21:09 3,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2006-12-19 21:09 <DIR> d-------- C:\Program Files\Grisoft
2006-12-18 18:26 <DIR> d-------- C:\FOUND.006
2006-12-17 08:57 <DIR> d-------- C:\HiJackThis
2006-12-16 22:45 <DIR> d-------- C:\fixwareout
2006-12-16 16:17 <DIR> d-------- C:\FOUND.005
2006-12-16 15:39 <DIR> d-------- C:\WINDOWS\Minidump
2006-12-16 15:39 <DIR> d-------- C:\FOUND.004
2006-12-14 22:51 <DIR> d-------- C:\WINDOWS\SYSTEM32\drv32dta
2006-12-14 22:20 38,912 --a------ C:\WINDOWS\SYSTEM32\aspi1470512.exe
2006-12-14 22:14 81,920 --a------ C:\WINDOWS\SYSTEM32\Packet.dll
2006-12-14 22:14 61,440 --a------ C:\WINDOWS\SYSTEM32\WanPacket.dll
2006-12-14 22:14 53,299 --a------ C:\WINDOWS\SYSTEM32\pthreadVC.dll
2006-12-14 22:14 32,512 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\npf.sys
2006-12-14 22:14 233,472 --a------ C:\WINDOWS\SYSTEM32\wpcap.dll
2006-12-14 21:58 46,592 --a------ C:\WINDOWS\SYSTEM32\zlbw.dll
2006-12-14 21:55 393 --a------ C:\WINDOWS\SYSTEM32\z16.exe
2006-12-14 21:55 391 --a------ C:\WINDOWS\SYSTEM32\z14.exe
2006-12-14 21:54 5,120 --a------ C:\WINDOWSsystem32alg.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
Rootkit driver pe386 is present. A rootkit scan is required
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SystemTray"="SysTray.Exe"
"Synchronization Manager"="mobsync.exe /logon"
"HP OfficeJet Series 700"="\"C:\\Program Files\\Hewlett-Packard\\HP OfficeJet Series 700 NT\\bin\\ktchnsnk.exe\" -reg \"Software\\Hewlett-Packard\\OfficeJet Series 700\\Install\""
"ConMgr.exe"="\"C:\\Program Files\\EarthLink 5.0\\ConMgr.exe\""
"UpdateMgr.exe"="\"C:\\Program Files\\EarthLink 5.0\\updatemgr.exe\" /NOCM"
"RFX_auto_upgrade"=""
"IW Controlcenter"="C:\\PROGRA~1\\INSTAN~1\\INSTAN~1\\IWCTRL.EXE"
"HPAIO_PrintFolderMgr"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\hpoopm07.exe"
"Gene USB Monitor"="C:\\WINDOWS\\system32\\USBMonit.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"TangoManager"="C:\\PROGRA~1\\FRONTI~1\\FRONTI~1\\app\\TANGOM~1.EXE"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SSC_UserPrompt"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"SDFix"="C:\\DOCUME~1\\ADMINI~1\\DESKTOP\\SDFIX\\SDFIX\\RUNTHIS.BAT /second"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c4,01,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,b5,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\DELL\\channel\\DESKTOP\\Index.htm"
"SubscribedURL"="C:\\DELL\\channel\\DESKTOP\\Index.htm"
"FriendlyName"=""
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,aa,01,00,00,9b,00,00,00,a6,00,00,00,3d,01,00,00,ea,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,aa,01,00,00,9b,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,aa,01,00,00,9b,00,00,00,a6,00,00,00,3d,01,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="131A6951-7F78-11D0-A979-00C04FD705A2"
"SubscribedURL"="131A6951-7F78-11D0-A979-00C04FD705A2"
"FriendlyName"="Internet Explorer Channel Bar"
"Flags"=dword:00000003
"Position"=hex:2c,00,00,00,50,01,00,00,1f,00,00,00,80,00,00,00,76,00,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,00,03,00,00,13,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,03,00,00,13,00,00,00,54,00,00,00,aa,01,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nwprovau
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
backup-20061219-212152-963
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
backup-20061219-212152-718
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
backup-20061219-212152-764
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\System32\nzdd0.dll
backup-20061219-212152-392
O4 - HKLM\..\Run: [rock] rock.exe
backup-20061219-212152-675
O4 - HKLM\..\Run: [WinSysModule] dsrss.exe
backup-20061219-212152-497
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMINI~1\Desktop\SDFix\SDFix\RunThis.bat /second
backup-20061219-212152-801
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.findthewebsiteyouneed.com/
backup-20061219-212152-757
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
backup-20061219-212152-436
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
backup-20061219-212152-128
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
backup-20061219-212152-678
O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINDOWS\system32\baagf32.dll (file missing)
backup-20061219-212152-139
O21 - SSODL: LIJKE - {07CE0A0D-AD64-A0A7-9BB6-58AA4D7D07D8} - C:\WINDOWS\system32\jhuiq.dll (file missing)
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Tune-up Application Start.job
C:\WINDOWS\tasks\Maintenance-Defragment programs.job
C:\WINDOWS\tasks\Maintenance-Disk cleanup.job
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - pbroenen.job
Completion time: Fri 2006-12-22 18:22:45.51
C:\ComboFix.txt ... 06-12-22 18:22
Mr_JAk3,
I Googled the above message regarding rootkit (in red) and found a message on GeeksToGo.com. The message said to download and run rustbfix.exe. I did this. The PC automatically rebooted a couple of times, did some magic, and came up in Normal Mode! :bigthumb:
Logs to follow...
Please advise whether there is more that I should do to cleanse my PC and to prepare it for networking safely.
Thanks!
P
************************* Rustock.b-fix -- By ejvindh *************************
Fri 12/22/2006 18:40:44.64
******************* Pre-run Status of system *******************
Rootkit driver PE386 is found. Starting the unload-procedure....
Rustock.b-ADS attached to the System32-folder:
No streams found.
Looking for Rustock.b-files in the System32-folder:
system32\lzx32.sys FOUND!
attempting to delete lzx32.sys from system32-folder
******************* Post-run Status of system *******************
Rustock.b-driver on the system: NONE!
Rustock.b-ADS attached to the System32-folder:
No System32-ADS found.
Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32
******************************* End of Logfile ********************************
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\umnlqicw
*******************
Script file located at: \??\C:\Documents and Settings\diuviftd.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.
Completed script processing.
*******************
Finished! Terminate.
SDFix: Version 1.49
****************
Mon 12/18/2006 - 19:45:03.67
Microsoft Windows 2000 [Version 5.00.2195]
Running From: C:\DOCUME~1\ADMINI~1\Desktop\SDFix\SDFix
Stage One - Safe Mode
Checking Services...
Service Name:
File Path:
Starting Registry Repairs...
Restoring Default Hosts File...
Stage One Complete
Rebooting...
Stage Two - Normal Mode
Checking For Malware:
--------------------
C:\WINDOWS\system32\aspi149112.exe
C:\WINDOWS\SYSTEM32\Z16.EXE
C:\WINDOWS\SYSTEM32\Z2524.EXE
C:\WINDOWS\SYSTEM32\Z14.EXE
C:\WINDOWS\SYSTEM32\MDMEX7.EXE
C:\WINDOWS\SYSTEM32\Z2333.EXE
C:\WINDOWS\SYSTEM32\Z16.EXE
C:\WINDOWS\SYSTEM32\Z2524.EXE
C:\WINDOWS\SYSTEM32\Z14.EXE
C:\WINDOWS\SYSTEM32\MDMEX7.EXE
C:\WINDOWS\SYSTEM32\Z2333.EXE
C:\WINDOWS\emdat.tm
C:\WINDOWS\emdat.tmp
C:\WINDOWS\system32\drivers\etc\hosts.tim
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\ws386.ini
Backing Up and Removing any Files Found...
Alternate Stream Check:
C:\WINDOWS\system32
No streams found.
Final Check:
Services:
---------
Files:
------
Backups Folder: - C:\DOCUME~1\ADMINI~1\Desktop\SDFix\SDFix\backups\backups.zip
Checking for files with Hidden Attributes:
C:\ZZ.EXE
C:\IO.SYS
C:\LOGO.SYS
C:\redir.sys
C:\PAGEFILE.SYS
C:\WINDOWS\page files\maxmeg.sys
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL2141.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL1097.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL3732.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL2424.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL2834.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL3170.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL1211.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL0428.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL0341.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\~WRL3036.tmp
C:\Documents and Settings\pbroenen\Local Settings\Temp\$b17a2e8.tmp
C:\My Documents\~WRL1065.tmp
C:\My Documents\~WRL1939.tmp
C:\My Documents\~WRL2728.tmp
C:\My Documents\~WRL1539.tmp
C:\My Documents\~WRL0203.tmp
C:\My Documents\Resume\~WRL3695.tmp
C:\My Documents\I T P\~WRL3162.tmp
C:\My Documents\I T P\Ph.D\~WRL0379.tmp
C:\My Documents\I T P\Ph.D\~WRL2708.tmp
C:\My Documents\I T P\Ph.D\~WRL2998.tmp
C:\My Documents\I T P\Ph.D\~WRL1099.tmp
C:\My Documents\I T P\Ph.D\~WRL0628.tmp
C:\My Documents\I T P\Ph.D\~WRL4093.tmp
C:\My Documents\I T P\Ph.D\~WRL1517.tmp
C:\My Documents\I T P\Ph.D\~WRL1824.tmp
C:\My Documents\I T P\Ph.D\~WRL1056.tmp
C:\My Documents\I T P\Ph.D\~WRL2273.tmp
C:\My Documents\I T P\Ph.D\~WRL2519.tmp
C:\My Documents\I T P\Ph.D\~WRL3562.tmp
C:\My Documents\I T P\Ph.D\~WRL0937.tmp
C:\My Documents\I T P\Ph.D\~WRL0597.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2448.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2931.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3694.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1440.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1429.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0510.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0552.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0158.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3361.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3512.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1561.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL4002.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3970.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3018.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3568.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1381.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1000.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3360.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3976.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2865.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2845.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2686.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1899.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1230.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3235.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1791.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0600.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0661.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3024.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0362.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0993.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3594.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1937.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0115.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0615.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3398.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0721.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1586.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3435.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1331.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2050.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3335.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1794.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2654.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2687.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1653.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2812.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0027.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3943.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3772.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2517.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2128.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1407.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3497.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2730.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1307.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1455.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3502.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1018.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0147.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3126.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2012.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2287.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1577.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3336.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3560.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1198.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0928.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0761.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3214.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0965.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3587.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3358.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3663.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2651.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2274.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0535.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2500.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0858.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2024.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0750.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3574.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2650.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0599.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL2652.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3908.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0582.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3321.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0430.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3697.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL1068.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0198.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3189.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0697.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL0712.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL3192.tmp
C:\My Documents\I T P\Ph.D\965 - Doctoral Research and Process\~WRL4033.tmp
C:\My Documents\I T P\Ph.D\Dissertation\~WRL1267.tmp
C:\My Documents\I T P\Ph.D\Dissertation\~WRL1641.tmp
C:\My Documents\I T P\MA\M600 Intro to Transpersonal\~WRL0977.tmp
C:\My Documents\I T P\MA\M600 Intro to Transpersonal\~WRL2221.tmp
C:\My Documents\IntegriData\ETAK\~WRL1791.tmp
FINISHED!
Logfile of HijackThis v1.99.1
Scan saved at 7:03:05 PM, on 12/22/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\WINDOWS\system32\USBMonit.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TangoManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSOffice\Office\Osa.exe
C:\Program Files\Greetings Workshop\Gwremind.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSOffice\Office\Findfast.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
C:\PROGRA~1\HEWLET~1\HPOFFI~1\bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOSTS07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOFXM07.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700 NT\bin\ktchnsnk.exe" -reg "Software\Hewlett-Packard\OfficeJet Series 700\Install"
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: RealDownload.lnk = C:\Program Files\REAL\RealDownload\Realdownload.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gtfc.com,gtservicing.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gtfc.com,gtservicing.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gtfc.com,gtservicing.com
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corp
Very well done :D: :D:
The rustbfix & sdfix were exactly what I would have recommended next.
But please follow my instructions....
Now please run ComboFix again and post it's log along with a fresh HijackThis log to here. (the last HjT log wasn't complete)
Then we'll clear the rest :bigthumb:
Thanks, Mr_JAk3,
Sorry for jumping ahead. And sorry for the truncated HJT log. Fresh logs to follow.
BTW, when logged in in Normal Mode, I now have a desktop background blurbing about Active Desktop Recovery. I suspect that this is not legitimate. I also have a dodgy looking icon in my system tray that says "Updates are ready for you computer. Click here to install these updates." I am not at all inclined to ;)
P
Administrator - Sat 12/23/2006 21:18:59.60 Service Pack 4
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Administrator\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-11-23 to 2006-12-23 ))))))))))))))))))))))))))))))))))
2006-12-22 18:53 <DIR> d-------- C:\avenger
2006-12-22 18:40 <DIR> d-------- C:\Rustbfix
2006-12-21 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\DoctorWeb
2006-12-19 21:09 3,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2006-12-19 21:09 <DIR> d-------- C:\Program Files\Grisoft
2006-12-18 18:26 <DIR> d-------- C:\FOUND.006
2006-12-17 08:57 <DIR> d-------- C:\HiJackThis
2006-12-16 22:45 <DIR> d-------- C:\fixwareout
2006-12-16 16:17 <DIR> d-------- C:\FOUND.005
2006-12-16 15:39 <DIR> d-------- C:\WINDOWS\Minidump
2006-12-16 15:39 <DIR> d-------- C:\FOUND.004
2006-12-14 22:20 38,912 --a------ C:\WINDOWS\SYSTEM32\aspi1470512.exe
2006-12-14 22:14 81,920 --a------ C:\WINDOWS\SYSTEM32\Packet.dll
2006-12-14 22:14 61,440 --a------ C:\WINDOWS\SYSTEM32\WanPacket.dll
2006-12-14 22:14 53,299 --a------ C:\WINDOWS\SYSTEM32\pthreadVC.dll
2006-12-14 22:14 32,512 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\npf.sys
2006-12-14 22:14 233,472 --a------ C:\WINDOWS\SYSTEM32\wpcap.dll
2006-12-14 21:58 46,592 --a------ C:\WINDOWS\SYSTEM32\zlbw.dll
2006-12-14 21:54 5,120 --a------ C:\WINDOWSsystem32alg.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SystemTray"="SysTray.Exe"
"Synchronization Manager"="mobsync.exe /logon"
"RFX_auto_upgrade"=""
"IW Controlcenter"="C:\\PROGRA~1\\INSTAN~1\\INSTAN~1\\IWCTRL.EXE"
"HPAIO_PrintFolderMgr"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\hpoopm07.exe"
"Gene USB Monitor"="C:\\WINDOWS\\system32\\USBMonit.exe"
"TangoManager"="C:\\PROGRA~1\\FRONTI~1\\FRONTI~1\\app\\TANGOM~1.EXE"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"SSC_UserPrompt"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c4,01,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,b5,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\DELL\\channel\\DESKTOP\\Index.htm"
"SubscribedURL"="C:\\DELL\\channel\\DESKTOP\\Index.htm"
"FriendlyName"=""
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,aa,01,00,00,9b,00,00,00,a6,00,00,00,3d,01,00,00,ea,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,aa,01,00,00,9b,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,aa,01,00,00,9b,00,00,00,a6,00,00,00,3d,01,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="131A6951-7F78-11D0-A979-00C04FD705A2"
"SubscribedURL"="131A6951-7F78-11D0-A979-00C04FD705A2"
"FriendlyName"="Internet Explorer Channel Bar"
"Flags"=dword:00000003
"Position"=hex:2c,00,00,00,50,01,00,00,1f,00,00,00,80,00,00,00,76,00,00,00,ec,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,00,03,00,00,13,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,03,00,00,13,00,00,00,54,00,00,00,aa,01,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nwprovau
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Tune-up Application Start.job
C:\WINDOWS\tasks\Maintenance-Defragment programs.job
C:\WINDOWS\tasks\Maintenance-Disk cleanup.job
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - pbroenen.job
Completion time: Sat 2006-12-23 21:19:49.48
C:\ComboFix2.txt ... 06-12-22 18:22
C:\ComboFix.txt ... 06-12-23 21:19
Logfile of HijackThis v1.99.1
Scan saved at 9:23:01 PM, on 12/23/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\WINDOWS\system32\USBMonit.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSOffice\Office\Osa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TangoManager.exe
C:\Program Files\MSOffice\Office\Findfast.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
C:\PROGRA~1\HEWLET~1\HPOFFI~1\bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOSTS07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOFXM07.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\HiJackThis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
Ok let's get you cleaned :D:
You should print these instructions or save these to a text file. Follow these instructions carefully.
Update AVG Anti-Spyware.
Please download the Killbox (http://www.downloads.subratam.org/KillBox.zip).
Unzip it to the desktop but do NOT run it yet.
==================
Backup your registry:
Start
Run
Type the following to the box and hit Ok: regedit
A window opens, click on File
Choose Export form the menu
Change the save location to C:\
Give the filename, RegBackUp
Make sure that the filetype is set to Registryfiles (*.reg)
Click on Save and Close the window
Open Notepad (NOT WORDPAD!) and copy the following lines from the quote box below into a new document, leaving a blank line at the end. (don't forget to copy and paste the word REGEDIT4) :
REGEDIT4
[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.
Save the document to your desktop as Fix.reg and filetype: All Files
Go to your desktop and double click on the file to run Fix.reg and when it asks you if you want to merge the contents to the registry, click yes/ok.
Please run Killbox.
Select "Delete on Reboot".
Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\SYSTEM32\aspi1470512.exe
C:\WINDOWS\SYSTEM32\zlbw.dll
C:\WINDOWSsystem32alg.exe
Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
Select "All Files".
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
Restart your computer to the safe mode:
Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.
Run ATF Cleaner Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act?
Click on Recommended Action and choose Quarantine from the popup menu.
Under How to scan?
All checkboxes should be ticked.
Under Possibly unwanted software:
All checkboxes should be ticked.
Under Reports:
Select Automatically generate report after every scan and uncheck Only if threats were found.
Under What to scan?
Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
When done, click the Save Scan Report button. (4)
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
================
When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
:bigthumb:
Logfile of HijackThis v1.99.1
Scan saved at 3:46:41 PM, on 12/24/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.EXE
C:\HiJackThis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 3:44:43 PM 12/24/2006
+ Scan result:
C:\RECYCLED\NPROTECT\00012323.sys -> Hijacker.Costrat.l : Cleaned with backup (quarantined).
::Report end
Merry Christmas, Mr_JAk3 :D:
I followed your instructions--no more, no less. (Please see logs above.) What's next...?
P
Merry Christmas to you too :D:
Ok it is looking good now.
Please post a one more HijackThis log so that I can verify that you're clean.
(The last HijackThis log was taken in safe mode so please post a log from normal mode)
:bigthumb:
Thanks, Mr_JAk3,
Normal Mode HJT log to follow...
Please advise whether you think I'm safe to go back on the net. I want to try to update my Norton AV defs.
Thanks again,
P
Logfile of HijackThis v1.99.1
Scan saved at 10:22:12 AM, on 12/25/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\WINDOWS\system32\USBMonit.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TangoManager.exe
C:\Program Files\MSOffice\Office\Osa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSOffice\Office\Findfast.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
C:\PROGRA~1\HEWLET~1\HPOFFI~1\bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOSTS07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOFXM07.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\HiJackThis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - Global Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\MSOffice\Office\FINDFAST.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O20 - Winlogon Notify: nwprovau - C:\WINDOWS\SYSTEM32\nwprovau.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMPCI54G WLAN Monitor\WLService.exe" "WMP54G.exe (file missing)
Hi again, it is looking good now :)
I recommend that you update your Norton and run a full system scan with it.
Now you can clean AVG's Quarantine:
Open AVG Anti-Spyware
Click Infections
Click Quarantine tab
Click Select all
Click Remove finally
Close the program
You can remove the tools we used.
Now you can make your hidden files hidden again.
=============
Now that you seem to be clean, please follow these simple steps in order to keep your computer clean and secure:
Use ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1)
Download and install ATF Cleaner. Clean your temporary files & folders with it regularly.
Use Ad-Aware (http://www.bleepingcomputer.com/forums/?showtutorial=48)
Download and install Ad-Aware. Update it and scan your computer regularly with it.
Use AVG Anti-Spyware (http://www.ewido.net/en/)
Update it and scan your computer regularly with it.
Use Spybot S&D (http://www.bleepingcomputer.com/forums/?showtutorial=43)
Download and install Spybot S&D. Update it and scan your computer regularly with it.
Install SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)
SpywareBlaster will prevent spyware from being installed.
Install MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm)
This prevents your computer from connecting to harmful sites.
Use Firefox browser (http://www.mozilla.org)
Firefox is faster, safer and better browser than Internet Explorer.
Keep your systen up-to-date (http://windowsupdate.microsoft.com)
Visit Windows Update regularly.
Keep your antivirus and firewall up-to-date
Scan your computer regularly with your antivirus.
Read this article by TonyKlein (http://forums.spybot.info/showthread.php?t=279)
So how did I get infected in the first place?
Stand Up and Be Counted ! (http://www.malwarecomplaints.info/index.php)
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Stay clean and be safe :bigthumb:
Thank you, Mr_JAk3,
You are indeed a malware warrior. :bigthumb: I have expressed my gratitude in the monetary fashion suggested in the general forum threads.
As if now, I am able to boot normally and connect to the network. Services.exe is gobbling up 100% CPU, so I am attempting to get the latest Windows patches to see if that gets me zooming along again...
Then I'll see if I can upgrade my Norton AV LiveUpdate program, since it hangs every time I run it :spider:
A thousand thank yous for your wise guidance. All the best for 2007!
P
That's great news and you're very welcome :D:
Thank you for the donation :bigthumb:
As the problem appears to be resolved this topic has been archived.
If you need it re-opened please send a private message (pm) to a forum staff member and provide a link to the thread; this applies only to the original topic starter.
Glad we could help :2thumb: