virus blitz :(

Printable View

Show 40 post(s) from this thread on one page

February 14th, 2005, 11:18 AM
stargazer777

AnneMarie,

Thanks .... I am using quotes from your most recent post and responding (below):

Quote:

Originally posted by AnnMarie
I wonder if Zone Alarm is blocking IE. Uninstall it for now and enable XP's firewall. See here.

You uninstalled Panda? We need to fix up those entries in your log. I see that a proxy has been added and restrictions have been put in place. Close Internet Explorer and all open windows and run Hijack This again. Check the below entries and click on Fix Checked.

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS2\EliteToolBar\EliteToolBar.dll ALREADY DELETED - Dave

O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS2\EliteToolBar\EliteToolBar.dll ALREADY DELETED - Dave

O4 - HKLM\..\Run: [antiware] C:\windows2\system32\eliteppy32.exe ALREADY DELETED - Dave

O15 - Trusted Zone: *.finefind.nettraffic2cash.biz ALREADY DELETED - Dave

* * * Sorry, I guess my bold typeface didn't help ("ALREADY DELETED - Dave"), but the above items you listed for deleting had already been deleted. :)

BTW Where did all those GhostSurf startups come from?

* * * I use a program called GhostSurf (by Tenebril) to surf anonymously. It re-routes my connection through a long series of proxy servers. It is an "out-of-the-box" program, not downloaded or used online, so it should not be causing any problems.

UPDATE: I have my homepage on MSIE back (again), but of course *still* no internet connection, at least with a browser. I will kill Zone Alarm and follow your other instructions, and get back to you this evening (I am posting from work right now). I will include the logs you requested.

Also, I downloaded Microsoft's antispyware app; it seems to do an excellent job of deep scanning and reporting. However, there was one nasty installed which the MS app kept finding and deleting, but same old story ... something somewhere just slaps it right back into Windows again. I forget the name of the nasty but I will include it as well.

Thanks,
Dave
February 14th, 2005, 07:54 PM
AnnMarie

Hi Dave, I did see those entries in your log but I thought I was looking at the most recent log and assumed that you meant they had reinstated themselves.

I knew that you had GhostSurf but as you couldnt get online, I couldnt understand why those entries were there. They did not show in earlier logs. It's possible that the below entry belongs to GhostSurf:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:7212

I would still like you to fix it but you may have to reinstate it if you have problems using GhostSurf.
February 15th, 2005, 11:11 AM
stargazer777

Hi all . . .

AnneMarie,. did everything you said, *except* the activation of WinXP firewall failed. See attached file of screen shot showing message given. Looking at screen shot: I'd just clicked to check box labeled "Protect my computer ..." then clicked OK, when msg. window at right appeared.

Also following - (1) HJT log & (2) SilentRunner log:

NOTE: After running the report for you, I *deleted* the items in BOLD:

Logfile of HijackThis v1.99.0
Scan saved at 12:33:10 AM, on 2/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\SYSTEM32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\Explorer.EXE
D:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS2\System32\devldr32.exe
D:\Program Files\Logitech\iTouch\kbdtray.exe
D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS2\System32\ctfmon.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Program Files\Plextor\PlexTool.exe
D:\Program Files\SpySubtract\SpySub.exe
C:\WINDOWS2\System32\wuauclt.exe
D:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:7212
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [Uma] C:\Documents and Settings\Dave.DGATES1\Application Data\tbtm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PlexTools Professional.lnk = D:\Program Files\Plextor\PlexTool.exe
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySubtract\SpySub.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Allow personal info to reach this site - file://D:\Program Files\GhostSurf\info.allow.html
O8 - Extra context menu item: Allow popups on this site - file://D:\Program Files\GhostSurf\popup.allow.html
O8 - Extra context menu item: Allow this advertisement - file://D:\Program Files\GhostSurf\menu.allowimg.html
O8 - Extra context menu item: Block personal info from this site - file://D:\Program Files\GhostSurf\info.block.html
O8 - Extra context menu item: Block popups on this site - file://D:\Program Files\GhostSurf\popup.block.html
O8 - Extra context menu item: Block this advertisement - file://D:\Program Files\GhostSurf\menu.blockimg.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104543957578
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C83C5C97-CD0D-4C5D-B1F8-EBB7E44F6FD4}: NameServer = 192.168.2.1,38.9.212.2
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - (no file)
O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} - (no file)
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: VET Message Service - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WinTab Service - Tablet Driver - C:\WINDOWS2\System32\DRIVERS\WtSrv.exe

===================================

"Silent Runners.vbs", revision RED (R28) (Echo output), launched at: 00:39
Operating System: Windows XP

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"Uma" = "C:\Documents and Settings\Dave.DGATES1\Application Data\tbtm.exe" [file not found]
"ctfmon.exe" = "C:\WINDOWS2\System32\ctfmon.exe" [MS]
"LDM" = "D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"zBrowser Launcher" = "D:\Program Files\Logitech\iTouch\iTouch.exe" ["Logitech Inc. "]
"RoxioDragToDisc" = ""D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"" ["Roxio"]
"RemoteControl" = "C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe" ["Cyberlink Corp."]
"Logitech Utility" = "Logi_MwX.Exe" [file not found]
"AdaptecDirectCD" = ""C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"" ["Roxio"]
"CaAvTray" = ""D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"" ["Computer Associates International, Inc."]
"CAVRID" = ""D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"" ["Computer Associates International, Inc."]
"gcasServ" = ""D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]

HKLM\Software\Microsoft\Active Setup\Installed Components\
">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "Microsoft Windows Media Player"
\StubPath = "C:\WINDOWS2\inf\unregmp2.exe /ShowWMP" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\
INFECTION WARNING! "{5FFD4A60-C328-128D-44EB-21D258091D15}" = "Delayed Applications Handler"
-> resolves to: {CLSID}\InprocServer32\(Default) = blank [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"PostBootReminder" = "{7849596a-48ea-486e-8937-a2a3009f31a9}"
-> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS2\system32\SHELL32.dll" [MS]
"CDBurn" = "{fbeb8a05-beee-4442-804e-409d6c4515e9}"
-> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS2\system32\SHELL32.dll" [MS]
"WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
-> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS2\System32\webcheck.dll" [MS]
"SysTray" = "{35CEC8A3-2BE6-11D2-8773-92E220524153}"
-> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINDOWS2\System32\stobject.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! "AtiExtEvent\DLLName" = "(no data)" [file not found]

Startup items in "Dave" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\All Users.WINDOWS2\Start Menu\Programs\Startup
"Logitech Desktop Messenger" -> shortcut to: "D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start" [empty string]
"Microsoft Office" -> shortcut to: "D:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
"PlexTools Professional" -> shortcut to: "D:\Program Files\Plextor\PlexTool.exe Startup" ["Plextor SA/NV"]
"SpySubtract" -> shortcut to: "D:\Program Files\SpySubtract\SpySub.exe -autostart" ["InterMute, Inc."]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Automatic Updates, wuauserv, "C:\WINDOWS2\system32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\wuauserv.dll" [MS]}
CAISafe, CAISafe, "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe" ["Computer Associates International, Inc."]
COM+ Event System, EventSystem, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\es.dll" [MS]}
Computer Browser, Browser, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\browser.dll" [MS]}
Cryptographic Services, CryptSvc, "C:\WINDOWS2\system32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\cryptsvc.dll" [MS]}
DHCP Client, Dhcp, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\dhcpcsvc.dll" [MS]}
Distributed Link Tracking Client, TrkWks, "C:\WINDOWS2\system32\svchost.exe -k netsvcs" {"C:\WINDOWS2\system32\trkwks.dll" [MS]}
DNS Client, Dnscache, "C:\WINDOWS2\System32\svchost.exe -k NetworkService" {"C:\WINDOWS2\System32\dnsrslvr.dll" [MS]}
Error Reporting Service, ERSvc, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\ersvc.dll" [MS]}
Event Log, Eventlog, "C:\WINDOWS2\system32\services.exe" [MS]
Fast User Switching Compatibility, FastUserSwitchingCompatibility, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\shsvcs.dll" [MS]}
Help and Support, helpsvc, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\PCHealth\HelpCtr\Binaries\pchsvc.dll" [MS]}
IPSEC Services, PolicyAgent, "C:\WINDOWS2\System32\lsass.exe" [MS]
Logical Disk Manager, dmserver, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\dmserver.dll" ["Microsoft Corp."]}
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Messenger, Messenger, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\msgsvc.dll" [MS]}
Network Connections, Netman, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\netman.dll" [MS]}
Network Location Awareness (NLA), Nla, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\mswsock.dll" [MS]}
Plug and Play, PlugPlay, "C:\WINDOWS2\system32\services.exe" [MS]
Print Spooler, Spooler, "C:\WINDOWS2\system32\spoolsv.exe" [MS]
Protected Storage, ProtectedStorage, "C:\WINDOWS2\system32\lsass.exe" [MS]
Remote Procedure Call (RPC), RpcSs, "C:\WINDOWS2\system32\svchost -k rpcss" {"C:\WINDOWS2\system32\rpcss.dll" [MS]}
Remote Registry, RemoteRegistry, "C:\WINDOWS2\system32\svchost.exe -k LocalService" {"C:\WINDOWS2\system32\regsvc.dll" [MS]}
Secondary Logon, seclogon, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\seclogon.dll" [MS]}
Security Accounts Manager, SamSs, "C:\WINDOWS2\system32\lsass.exe" [MS]
Server, lanmanserver, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\srvsvc.dll" [MS]}
Shell Hardware Detection, ShellHWDetection, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\shsvcs.dll" [MS]}
SSDP Discovery Service, SSDPSRV, "C:\WINDOWS2\System32\svchost.exe -k LocalService" {"C:\WINDOWS2\System32\ssdpsrv.dll" [MS]}
System Event Notification, SENS, "C:\WINDOWS2\system32\svchost.exe -k netsvcs" {"C:\WINDOWS2\system32\sens.dll" [MS]}
System Restore Service, srservice, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\srsvc.dll" [MS]}
Task Scheduler, Schedule, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\system32\schedsvc.dll" [MS]}
TCP/IP NetBIOS Helper, LmHosts, "C:\WINDOWS2\System32\svchost.exe -k LocalService" {"C:\WINDOWS2\System32\lmhsvc.dll" [MS]}
Terminal Services, TermService, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\termsrv.dll" [MS]}
Themes, Themes, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\shsvcs.dll" [MS]}
Upload Manager, uploadmgr, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\PCHealth\HelpCtr\Binaries\pchsvc.dll" [MS]}
VET Message Service, VETMSGNT, "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe" ["Computer Associates International, Inc."]
WebClient, WebClient, "C:\WINDOWS2\System32\svchost.exe -k LocalService" {"C:\WINDOWS2\System32\webclnt.dll" [MS]}
Windows Audio, AudioSrv, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\audiosrv.dll" [MS]}
Windows Management Instrumentation, winmgmt, "C:\WINDOWS2\system32\svchost.exe -k netsvcs" {"C:\WINDOWS2\system32\wbem\WMIsvc.dll" [MS]}
Windows Time, W32Time, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\w32time.dll" [MS]}
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS2\System32\wdfmgr.exe" [MS]
WinTab Service, WinTabService, "C:\WINDOWS2\System32\DRIVERS\WtSrv.exe" ["Tablet Driver"]
Wireless Zero Configuration, WZCSVC, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\wzcsvc.dll" [MS]}
Workstation, lanmanworkstation, "C:\WINDOWS2\System32\svchost.exe -k netsvcs" {"C:\WINDOWS2\System32\wkssvc.dll" [MS]}

Cheers,
- Dave
February 15th, 2005, 04:47 PM
AnnMarie

Try this Dave, go to Start > Run and type:

SERVICES.MSC

and hit enter. Scroll down to "Internet Connection Firewall (ICF), rightclick on this service and select "Start". Then go back and enable your firewall.

The Silent Runners log shows me that EZ AntiVirus did a good job of cleaning up your OS. Are you able to get online yet? If not, did you try installing another browser yet, you were considering this.

A final cleanup hopefully. Close Internet Explorer and all open windows and run Hijack This again. Check the below entries and click on Fix Checked. I have not included the items that you have fixed on the assumption that they are no longer there now. When you post your next log, please post a log that was run after you made the changes and rebooted.

O4 - HKCU\..\Run: [Uma] C:\Documents and Settings\Dave.DGATES1\Application Data\tbtm.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O17 - HKLM\System\CCS\Services\Tcpip\..\{C83C5C97-CD0D-4C5D-B1F8-EBB7E44F6FD4}: NameServer = 192.168.2.1,38.9.212.2

O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - (no file)

O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} - (no file)

Reboot, run another scan and post a new log.
February 15th, 2005, 10:53 PM
stargazer777

Quote:

Originally posted by AnnMarie
Try this Dave, go to Start > Run and type:

SERVICES.MSC

and hit enter. Scroll down to "Internet Connection Firewall (ICF), rightclick on this service and select "Start". Then go back and enable your firewall.

Ann,

I'm dead from the get-go. The ICF isn't even listed in Services!! I am supposing it's "missing in action", and I for one have no idea how to restore it onto the Services list. I'll keep an eye out for your reply, but while I'm waiting, I'll check around on the Web for some ideas.

- Dave

P.S. At what point to I/we hoist the white flag, wipe the C: partition and reinstall Windows ? :confused:
February 15th, 2005, 11:49 PM
stargazer777

Hi all . . .

Ann, I just did the things you said to. However, when I use HJT to delete

O15 - Trusted Zone: *.finefind.nettraffic2cash.biz

and then scan again just seconds later, it's back again !!

===============================

On the brighter side, I happened to try MSIE and it fired up and is working !!!

However, EZ AV popped up while I was resetting MSIE's security level and reported 4 instances of infection by the Win32.Bube virus (you had mentioned earlier) -- please see my attached JPG screenshot.

As you can see, EZ AV cleaned it from the C:\WINDOWS\system32 location, but was unable to clean it from the explorer.exe location.

Am going to try Housecall, then check back here later.

- Dave
February 16th, 2005, 12:42 AM
stargazer777

Oh, geezz ..... :mad: :mad: :mad:

First of all, I guess explorer.exe is whacked .... I must start it manually by doing a C-A-D and then select NEW TASK and start it.

Anyway ..... I just deleted all kinds of garbage after the a.v. scan, etc. .... did a Restart and then when my blank desktop showed up (only shows the display image, NO icons or taskbar), I performed the manual start for explorer.exe.

Immediately, a DOS window came up with dozens of lines zipping by, saying something like "Executing trojan blah blah blah (filenames etc.)" .... after I got past my shock I immediately hit the "X" button at the upper right on the DOS window.

Something in it cued me to the fact that this was all contained in a file named "tsc.exe". When I did a file search, using the criteria tsc.*, several items came up -- see attached JPG image.

Is this possible ..... someone installing a "seeding file" that executes dozens of trojan items all at once ??

Anne: I assume the items shown in the image file I've attached should all be deleted, but I hate assuming, when I'm not the wizard. I'll wait for your comments, and shut down.

- Dave
February 16th, 2005, 11:54 PM
AnnMarie

Can you send me a copy of that file please Dave. When you find it, copy it to a new folder, zip it up (this is important) and email it to me (include a link to this thread). My address is [email protected]. I will post back when I have checked it out.

A new verson of Hijack This was relased yesterday. Go here and download the latest version. Run Hijack This again and post a new log.
February 17th, 2005, 12:52 AM
stargazer777

Annie -

I downloaded the new HJT app as you instructed. Below is the resulting log:

Logfile of HijackThis v1.99.1
Scan saved at 11:46:36 PM, on 2/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\SYSTEM32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\explorer.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS2\System32\devldr32.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
D:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Logitech\iTouch\kbdtray.exe
C:\WINDOWS2\System32\ctfmon.exe
D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Plextor\PlexTool.exe
D:\Program Files\SpySubtract\SpySub.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dave.DGATES1\Desktop\MALWARE Utilities\HijackThis.exe

O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PlexTools Professional.lnk = D:\Program Files\Plextor\PlexTool.exe
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySubtract\SpySub.exe
O8 - Extra context menu item: Allow personal info to reach this site - file://D:\Program Files\GhostSurf\info.allow.html
O8 - Extra context menu item: Allow popups on this site - file://D:\Program Files\GhostSurf\popup.allow.html
O8 - Extra context menu item: Allow this advertisement - file://D:\Program Files\GhostSurf\menu.allowimg.html
O8 - Extra context menu item: Block personal info from this site - file://D:\Program Files\GhostSurf\info.block.html
O8 - Extra context menu item: Block popups on this site - file://D:\Program Files\GhostSurf\popup.block.html
O8 - Extra context menu item: Block this advertisement - file://D:\Program Files\GhostSurf\menu.blockimg.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104543957578
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS2\System32\DRIVERS\WtSrv.exe

I keep deleting the entry
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
using HJT, but moments later it is back again.

- Dave
February 17th, 2005, 01:15 AM
AnnMarie

Try fixing the below entries using the latest version of Hijack This Dave. (close IE first).

O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)

Reboot afterwards and post a new log. I am sure that I mentioned this before but perhaps not, go here and download, unzip and run the Registry Search Tool. Type nettraffic2cash in the dialog box. Let it run and after a few minutes, a prompt will appear. Click OK to write the results to Notepad and post them.

I havent received that file yet but there is no evidence of new malware in your log. Can you still get online?
February 17th, 2005, 01:24 AM
stargazer777

Quote:

Originally posted by AnnMarie
I havent received that file yet but there is no evidence of new malware in your log. Can you still get online?

AnneMarie,

Yes, I still have online access, although I am using Mozilla Firefox instead of MSIE, just in case it is less vulnerable, as I have heard.

I am assuming that procedures performed with HJT and other tools should be done in SAFE mode. If there is anything that does NOT, let me know ... it's a pain switching back and forth between Normal and Safe, and I don't have internet usage in Safe mode.

Also, regarding your use of the term "malware" -- is HJT going to show items related to viruses and trojans ? I have been overrun with them, but I had the idea HJT was only for spyware and hijacking nasties.

Will be posting again soon .... thanks again.

- Dave
February 17th, 2005, 02:03 AM
AnnMarie

1 Attachment(s)

Thanks I received the file Dave. It's not a trojan, it's the Trend Micro Damage Cleanup Engine.

Quote:

is HJT going to show items related to viruses and trojans ? I have been overrun with them, but I had the idea HJT was only for spyware and hijacking nasties.

Hijack This shows 99% of trojans and most viruses, the exception being file infectors which you currently have.

I need you to be able to use Internet Explorer. Please run the IEfix utility. You can download it here. Close IE first and reboot afterwards.

I have attached a zipped copy of Explorer.exe (SP1) to this post. Download it to your Desktop and upzip it. Once you have confirmed that IE is operative, we are going to replace your infected version of Explorer.exe with a clean one.

Dont forget to post a new Hijack This log and the results of your registry search if the entry is still there.
February 17th, 2005, 09:33 AM
stargazer777

Thanks, Annie -

1.) I performed the Explorer Fix.

2.) How do I replace Explorer.exe ? I tried an overwrite, and as I expected, it gave me a message something like "Make sure the file or app isn't in use." Seems like a Catch-22 -- I need to replace a file that has to be running while I try to replace it. I'll try again tonight after work.

My new HJT log follows after my sig . . . as you can see, that ruddy 015 - nettraffic2cash.biz entry still shows up . . .

Cheers,
Dave

Logfile of HijackThis v1.99.0
Scan saved at 8:27:42 AM, on 2/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\SYSTEM32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\explorer.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS2\System32\devldr32.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
D:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Logitech\iTouch\kbdtray.exe
C:\WINDOWS2\System32\ctfmon.exe
D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Plextor\PlexTool.exe
D:\Program Files\SpySubtract\SpySub.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
D:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PlexTools Professional.lnk = D:\Program Files\Plextor\PlexTool.exe
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySubtract\SpySub.exe
O8 - Extra context menu item: Allow personal info to reach this site - file://D:\Program Files\GhostSurf\info.allow.html
O8 - Extra context menu item: Allow popups on this site - file://D:\Program Files\GhostSurf\popup.allow.html
O8 - Extra context menu item: Allow this advertisement - file://D:\Program Files\GhostSurf\menu.allowimg.html
O8 - Extra context menu item: Block personal info from this site - file://D:\Program Files\GhostSurf\info.block.html
O8 - Extra context menu item: Block popups on this site - file://D:\Program Files\GhostSurf\popup.block.html
O8 - Extra context menu item: Block this advertisement - file://D:\Program Files\GhostSurf\menu.blockimg.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104543957578
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: VET Message Service - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WinTab Service - Tablet Driver - C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
February 17th, 2005, 03:10 PM
AnnMarie

.

Quote:

How do I replace Explorer.exe ? I tried an overwrite, and as I expected, it gave me a message something like "Make sure the file or app isn't in use." Seems like a Catch-22 -- I need to replace a file that has to be running while I try to replace it. I'll try again tonight after work.

I will talk you through the process Dave. I need confirmation from you that Internet Explorer is fully functional first though.

Quote:

My new HJT log follows after my sig . . . as you can see, that ruddy 015 - nettraffic2cash.biz entry still shows up .

Yes, I am waiting for you to post the results of running the Registry Search utility. We need to get rid of that before we replace Explorer.
February 17th, 2005, 04:43 PM
stargazer777

OK, thanks Annie -

Yes, MSIE is running fine, it seems.

I'm at work now, and will be out for the evening, but will return later and perform the RegSearch.

I think you're 16 hours ahead of me, so I should be back online around 3 PM your time. I know you have your own schedule and things to do, that's just for your info :) I'll have around 3 hours after that to work on this stuff, but if it doesnt get done, I can continue in the morning.

FYI, EZ AV found another virus, but killed it.

- Dave

Show 40 post(s) from this thread on one page