|
|
|||||||
| Spyware Cleaning Section Closed!! |
| Notice: The spyware cleaning (HijackThis) section is closed. Wilders Security no longer provides one on one spyware cleaning assistance. Please see this announcement for a list of websites that provide such services. |
|
|
Thread Tools | Search this Thread |
|
#1
July 10th, 2004, 11:30 AM
|
||||
|
||||
rundll32.exe
This doesn't appear to be life threatening but it's one of those annoying little things. For some reason (and this only started yesterday), whenever I close down my PC - ie clicking Start>Turn Off Computer, I get an annoying pop up box 'End Program - rundll32.exe' and I have to wait until the blue progress bar gets to the end after which, I get the message 'Ending program, please wait ...........' and I get the choice to click either 'End now' or 'Cancel'. If I click 'End now', the PC shuts down and if I click 'Cancel', it just goes back to my desktop.
It's really annoying and it's never happened before. Any ideas. Help much appreciated. 
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#2
July 10th, 2004, 03:54 PM
|
||||
|
||||
|
Re: rundll32.exe
Post the scan log from HijackThis
Unzip it somewhere to keep and run hijackthis.exe - press Scan - the Scan button changes to a Save Log button Save, and then copy and paste the entire log here. Dont' choose to fix anything yet - most entries will be harmless |
|
#3
July 10th, 2004, 04:28 PM
|
||||
|
||||
|
Re: rundll32.exe
Here's my HT log. It's really weird because I ran a virus scan whigh picked up around 24 'threats' (no infecred items) but when I ran Spybot and Adaware, the Spybot found nothing and the Adaware found 3 registry entrys which were removed. After my HT log, I've provided a list of what my AV program discovered. Incidentally, only 4 items could be removed. Do you think I should manually delete the rest? Why didn't Adaware pick these up? Thanks for looking at this :
Logfile of HijackThis v1.97.3 Scan saved at 21:09:59, on 10/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\hudelr.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Owner\Application Data\eber.exe C:\WINDOWS\System32\NDrv.exe C:\WINDOWS\System32\wcpsvsu.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\SpywareGuard\sgmain.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Mozilla Thunderbird\thunderbird.exe C:\Program Files\Norton AntiVirus\OPScan.exe C:\Program Files\Internet Explorer\iexplore.exe C:\MICHAEL'S STUFF\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freeserve.com/ R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [gbgqnawesh] C:\WINDOWS\System32\hudelr.exe O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\eber.exe O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpsvsu.exe O4 - Startup: Calendar.lnk = C:\Program Files\Calendar\cal.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0A6195BD-5E98-44CA-8FC9-62F3F5978C08}: NameServer = 195.92.195.94 195.92.195.95 Log of AV report : ,Threat category: AdwareSource: C:\WINDOWS\twaintec.dll,Description: The file C:\WINDOWS\twaintec.dll is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\system32\wcpsvsu.exe,Description: The file C:\WINDOWS\system32\wcpsvsu.exe is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\system32\jao.dll,Description: The file C:\WINDOWS\system32\jao.dll is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\system32\deluxnetwork.exe,Description: The file C:\WINDOWS\system32\deluxnetwork.exe is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\system32\bridge.dll,Description: The file C:\WINDOWS\system32\bridge.dll is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\system32\a.exe,Description: The compressed file a.exe within C:\WINDOWS\system32\a.exe is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\system32\a.exe,Description: The file C:\WINDOWS\system32\a.exe is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\preInsTT.exe,Description: The file C:\WINDOWS\preInsTT.exe is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\mxTarget.dll,Description: The file C:\WINDOWS\mxTarget.dll is a Adware threat. ,Threat category: AdwareSource: C:\WINDOWS\iNetPal\m3tsp8.exe,Description: The file C:\WINDOWS\iNetPal\m3tsp8.exe is a Adware threat. ,Threat category: Hack toolSource: C:\Program Files\Norton AntiVirus\keygen.exe,Description: The file C:\Program Files\Norton AntiVirus\keygen.exe is a Hack tool threat. ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THID7F.tmp\mxTarget.dll,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THID7F.tmp\mxTarget.dll is a Adware threat. ,Threat category: AdwareSource: mxTarget.dll,Description: The compressed file mxTarget.dll within C:\Documents and Settings\Owner\Local Settings\Temp\THID7F.tmp\mxTarget.cab is a Adware threat. ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.dll,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.dll is a Adware threat. ,Threat category: AdwareSource: polall1t.exe,Description: The compressed file polall1t.exe within polall1t.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat. ,Threat category: AdwareSource: polall1t.exe,Description: The compressed file polall1t.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat. ,Threat category: AdwareSource: preInsTT.exe,Description: The compressed file preInsTT.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat. ,Threat category: AdwareSource: twaintec.dll,Description: The compressed file twaintec.dll within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat. ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\preInsTT.exe,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\preInsTT.exe is a Adware threat. ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe,Description: The compressed file polall1t.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe is a Adware threat. ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe is a Adware threat. ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Application Data\eber.exe,Description: The file C:\Documents and Settings\Owner\Application Data\eber.exe is a Adware threat.
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#4
July 10th, 2004, 04:48 PM
|
||||
|
||||
|
Re: rundll32.exe
I would have preferred you to use the much newer version of HJT which I linked above
Use Taskmanager (Ctrl-Alt-Del) to end these running processes if you can (or use Process Explorer) C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\hudelr.exe C:\Documents and Settings\Owner\Application Data\eber.exe C:\WINDOWS\System32\wcpsvsu.exe You could try the uninstaller at http://www.purityscan.com/uninstall.html (but I can't vouch for it) Empty the TIF (Temporary Internet Files) To do so use Control Panel > Internet Options(or right click the IE icon on the desktop and choose Properties) Click Delete Files on the General Tab - place a check in the Delete all offline content box and then press OK Delete all the files in (and any subfolders of) the C:\Windows\Temp\ folder Run HijackThis again, push Scan and place a check mark next to the following items using your mouse. Next, close all browser Windows, and push the 'Fix checked' button in HijackThis R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R3 - URLSearchHook: (no name) - - (no file) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [gbgqnawesh] C:\WINDOWS\System32\hudelr.exe O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\eber.exe O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpsvsu.exe Reboot Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/ After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions. Now do the following: - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine: check: "Unload recognized processes during scanning." - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine: Check: "Let Windows remove files in use after reboot." Press "Scan Now" - Check option "Use Custom scanning options" - Check option "Activate In-Depth Scan" - Press "Select drives\folders to scan" - Select the active partition which is usually C: Now press "Next" to let Ad-aware scan your drives... It will find a number of "bad" files and registry keys. Right-click in that pane and choose "select all" Now press "Next" again. It will ask you whether you'd like to remove all checked items. Click OK. Finally, close Ad-Aware, and reboot. ----- Delete the following file(s): C:\Documents and Settings\Owner\Application Data\eber.exe C:\WINDOWS\System32\wcpsvsu.exe C:\WINDOWS\System32\bridge.dll C:\WINDOWS\System32\hudelr.exe ------ some partial info (for further cleanup) http://www.kephyr.com/spywarescanner....b/index.phtml ---- Post a fresh log when you're done |
|
#5
July 10th, 2004, 05:42 PM
|
||||
|
||||
|
Re: rundll32.exe
Followed your instructions and when I went to close down (to reboot) the annoying 'end program - rundll32.exe' did not appear. Thank you so much. You're a star! Here's my current HT log (from the version you linked to!!). I hope it's OK now. Maybe you can let me know? I still can't figure out why Adaware & Spybot didn't pick up all those files that my AV application did.
Thanks again. Logfile of HijackThis v1.98.0 Scan saved at 22:36:47, on 10/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\System32\svchost.exe C:\MICHAEL'S STUFF\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freeserve.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Calendar.lnk = C:\Program Files\Calendar\cal.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0A6195BD-5E98-44CA-8FC9-62F3F5978C08}: NameServer = 195.92.195.94 195.92.195.95 
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#6
July 10th, 2004, 05:51 PM
|
||||
|
||||
|
Re: rundll32.exe
There are indications of further problems
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank Download FindnFix http://downloads.subratam.org/FINDnFIX.exe Double Click on the FindnFix.exe you downloaded earlier and it will install into its own folder. That folder should be C:\FINDnFIX Browse to the folder Close all other open windows. Run (double click on) the !LOG!.bat file Have a coffee When it's done: From the FindnFix folder. - Post (paste) the contents of Log.txt in this thread. |
|
#7
July 11th, 2004, 01:17 PM
|
||||
|
||||
|
Re: rundll32.exe
Well. it didn't take long to run. Barely had time to fill the kettle! Never used FINDnFIX before so I'm not sure how it should look. Here's the log.txt. Is everything OK?
»»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»*** Read this first! ***»»»»»»»»»»»»»»»» Due to errors on various message boards I made some changes. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. If you make a mistake or use the wrong guidance, it is completely your responsibility and the helper that assists you. If you are not sure about the nature of the file or how to proceed, I suggest you research it first before attempting to remove any *unknown file on your own. *For Helpers and/or users that are not familiar with any of the items on the scan results- I recommend using an alternative, once you know what to look for! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» --The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder and is the destination for the file to be moved.. -*Previous directions will no longer work... »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q330994-Q824145-Q828750-Q832894-Q837009-Q831167 The type of the file system is NTFS. C: is not dirty. 11/07/2004 6:12pm up 0 days, 0:12 »»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/  »»»»»»»»»»»»»»»» Scanning for file(s)... »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ......... »»Locked or 'Suspect' file(s) found... C:\WINDOWS\System32\MS.DLL +++ File read error \\?\C:\WINDOWS\System32\MS.DLL +++ File read error »»»»» (*2*) »»»»»........ **File C:\FINDnFIX\LIST.TXT MS.DLL Can't Open! »»»»» (*3*) »»»»»........ C:\WINDOWS\SYSTEM32\ ms.dll Mon 31 May 2004 10:07:10 A...R 57,344 56.00 K nticdm~1.dll Sat 29 May 2004 23:37:58 ...HR 116 0.11 K 2 items found: 2 files (1 H/S), 0 directories. Total of file sizes: 57,460 bytes 56.11 K unknown/hidden files... C:\WINDOWS\SYSTEM32\ nticdm~1.dll Sat 29 May 2004 23:37:58 ...HR 116 0.11 K 1 item found: 1 file, 0 directories. Total of file sizes: 116 bytes 0.11 K »»»»» (*4*) »»»»»......... Sniffing.......... Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\MS.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NTICDM~1.DLL »»»»»(*5*)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT ¯ Access denied ® ..................... MS.DLL .....57344 31.05.2004 »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size... C:\WINDOWS\SYSTEM32\ ms.dll Mon 31 May 2004 10:07:10 A...R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\MS.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 0 »»Dumping Values........ »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Can't open Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: 2 - The system cannot find the file specified. »»Member of...: (Admin logon required!) User is a member of group MICHAEL\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created...»»»»»» 6:12pm up 0 days, 0:13 11/07/2004 File not found - key*.hiv File not found - keys1\winkey.reg C:\FINDNFIX\ JUNKXXX Sun 11 Jul 2004 7:32:32 .D... <Dir> 1 item found: 0 files, 1 directory. »»Performing string scan.... ERROR: failed to open file -------------- -------------- No matching files were found. -------------- -------------- Error: Couldn't open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#8
July 11th, 2004, 03:04 PM
|
||||
|
||||
|
Re: rundll32.exe
It shouldn't look like that if you are clean!
Here they've 'removed' the entire hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key which is showing size 0 It might take me a bit to research this one (btw - C:\WINDOWS\System32\MS.DLL is NOT a standard microsoft file but 57,460 is 'in the ballpark' for CWS) It might be something else. Last edited by IMM : July 11th, 2004 at 06:20 PM. |
|
#9
July 11th, 2004, 04:00 PM
|
||||
|
||||
|
Re: rundll32.exe
I've ran Adaware, Spybot (Search & Destroy) and CWS Shredder and nothing has been discovered. The original problem I had has been fixed though ie the box with 'End program - rundll32.exe' doesn't appear when I close down my PC.
Although I'm not quite clean, I'll await your findings and/or instructions following your further research.
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#10
July 11th, 2004, 06:07 PM
|
||||
|
||||
|
Re: rundll32.exe
I hate to put you through more stuff - but
Can you download http://download.broadbandmedic.com/VX2Finder(126).exe Press the Click to Find VX2 Betterinternet Button at the bottom. Click the Make Log Button. Copy and paste the contents of the log which will open into your next reply here. |
|
#11
July 12th, 2004, 04:16 AM
|
||||
|
||||
|
Re: rundll32.exe
Thanks. Actually, I don’t mind doing all this if the result is that my machine is clean at the end of it. It’s also a learning curve for myself. I’ve learned quite a bit from this experience. I’m at work right now but when I get home tonight, I’ll post the log from the downloaded application.
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#12
July 12th, 2004, 12:52 PM
|
||||
|
||||
|
Re: rundll32.exe
Well. IMM, here's the log as promised. Hope everythings OK?
Log for VX2.BetterInternet File Finder (msg126) Files Found--- Additional Files--- Keys Under Notify---crypt32chain Keys Under Notify---cryptnet Keys Under Notify---cscdll Keys Under Notify---igfxcui Keys Under Notify---ScCertProp Keys Under Notify---Schedule Keys Under Notify---sclgntfy Keys Under Notify---SensLogn Keys Under Notify---termsrv Keys Under Notify---wlballoon Guardian Key--- is called: User Agent String--- CDSource=ALLIED_01_01 IEAK
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#13
July 12th, 2004, 05:39 PM
|
||||
|
||||
|
Re: rundll32.exe
This one is going to be a pain
 I think we really need to delete the C:\WINDOWS\SYSTEM32\MS.DLL file first, and do the rest of the cleanup after. (you can't wait too long tho' for the rest - or you will likely re-infect You could first try booting to SAFE mode and deleting the file How to start the computer in Safe mode Quote:
Follow up with CWShredder and a fully updated Ad-Aware! If this fails I thinkwe'll end up using a recovery console http://www.windows-help.net/WindowsXP/howto-12.html This is very DOS like and you may need to have someone familiar with it help you Last edited by IMM : July 12th, 2004 at 05:49 PM. |
|
#14
July 13th, 2004, 07:07 AM
|
||||
|
||||
|
Re: rundll32.exe
Quote:
Sorry to be such a pain! Although I'm following your instructions to the letter, I'm a bit concerned as to how much my system is infected. Reading between the lines, if I successfully get rid of the \WINDOWS\SYSTEM32\MS.DLL file, it looks like I may be re-infected if I don't act quickly to clean up more stuff? I'll try and remove the file tonight and get back to you.
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#15
July 13th, 2004, 03:26 PM
|
||||
|
||||
|
Re: rundll32.exe
OK. I finally managed to delete MS.DLL from my system. I didn't know what you meant by 'comf.dll' or where to find it. What I did was rename MS.DLL then move the file to another folder. I then deleted it successfully. Ran a search for both the MS.DLL & renamed file and didn't find anything. What's the next step in the cleaning process?
Thanks.
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#16
July 13th, 2004, 05:41 PM
|
||||
|
||||
|
Re: rundll32.exe
Sorry about comf - should have read ms.dll
I reuse text and forgot to modify a bit there Post a fresh HJT log file Additionally, post the StartupList log. In HJT use Config > Misc Tools, put a check in "show minor sections" and then click "Generate Startuplist". ----------- Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/ After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions. Now do the following: - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine: check: "Unload recognized processes during scanning." - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine: Check: "Let Windows remove files in use after reboot." Press "Scan Now" - Check option "Use Custom scanning options" - Check option "Activate In-Depth Scan" - Press "Select drives\folders to scan" - Select the active partition which is usually C: Now press "Next" to let Ad-aware scan your drives... It will find a number of "bad" files and registry keys. Right-click in that pane and choose "select all" Now press "Next" again. It will ask you whether you'd like to remove all checked items. Click OK. Finally, close Ad-Aware, and reboot. |
|
#17
July 14th, 2004, 11:18 AM
|
||||
|
||||
|
Re: rundll32.exe
Here we are then. Adaware actually found only 2 suspect files (both identical) as follows which I promptly removed :
Possible browser hijack attempt : Software\Netscape\Netscape Navigator\Automation Protocolshttpdapns Unknown Object recognized! Type : RegData Data : "DAPNS.Protocol.1" Rootkey : HKEY_CURRENT_USER Object : Software\Netscape\Netscape Navigator\Automation Protocols Value : http Data : "DAPNS.Protocol.1" My Hijackthis & Startuplist logs follow. I'm hoping we're a bit nearer to total clenliness!? Logfile of HijackThis v1.98.0 Scan saved at 15:51:27, on 14/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\MICHAEL'S STUFF\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freeserve.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Calendar.lnk = C:\Program Files\Calendar\cal.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab _________________________________________________________________ StartupList report, 14/07/2004, 15:57:15 StartupList version: 1.52.2 Started from : C:\MICHAEL'S STUFF\HijackThis.EXE Detected: Windows XP SP1 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options * Showing rarely important sections ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\MICHAEL'S STUFF\HijackThis.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\Documents and Settings\Owner\Start Menu\Programs\Startup] Calendar.lnk = C:\Program Files\Calendar\cal.exe SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe hpsysdrv = c:\windows\system\hpsysdrv.exe HPHUPD05 = c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe HPHmon05 = C:\WINDOWS\System32\hphmon05.exe KBD = C:\HP\KBD\KBD.EXE UpdateManager = "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r Recguard = C:\WINDOWS\SMINST\RECGUARD.EXE PS2 = C:\WINDOWS\system32\ps2.exe NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup nwiz = nwiz.exe /installquiet /keeploaded /nodetect AlcxMonitor = ALCXMNTR.EXE NeroCheck = C:\WINDOWS\system32\NeroCheck.exe AdaptecDirectCD = "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe" TIxDSL = C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" Advanced Tools Check = C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE Device Detector = "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Acme.PCHButton = C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background -------------------------------------------------- Enumerating Active Setup stub paths: HKLM\Software\Microsoft\Active Setup\Installed Components (* = disabled by HKCU twin) [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP [>{26923b43-4d38-484f-9b9e-de460746276c}] * StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] * StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] * StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] * StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install [{7790769C-0471-11d2-AF11-00C04FA35D02}] * StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install [{89820200-ECBD-11cf-8B85-00AA005B4340}] * StubPath = regsvr32.exe /s /n /i:U shell32.dll [{89820200-ECBD-11cf-8B85-00AA005B4383}] * StubPath = %SystemRoot%\system32\ie4uinit.exe [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] * StubPath = C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\System32\scrnsave.scr drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Checking for EXPLORER.EXE instances: C:\WINDOWS\Explorer.exe: PRESENT! C:\Explorer.exe: not present C:\WINDOWS\Explorer\Explorer.exe: not present C:\WINDOWS\System\Explorer.exe: not present C:\WINDOWS\System32\Explorer.exe: not present C:\WINDOWS\Command\Explorer.exe: not present C:\WINDOWS\Fonts\Explorer.exe: not present -------------------------------------------------- Checking for superhidden extensions: .lnk: HIDDEN! (arrow overlay: yes) .pif: HIDDEN! (arrow overlay: yes) .exe: not hidden .com: not hidden .bat: not hidden .hta: not hidden .scr: not hidden .shs: HIDDEN! .shb: HIDDEN! .vbs: not hidden .vbe: not hidden .wsh: not hidden .scf: HIDDEN! (arrow overlay: NO!) .url: HIDDEN! (arrow overlay: yes) .js: not hidden .jse: not hidden -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2} NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} -------------------------------------------------- Enumerating Task Scheduler jobs: 1-Click Maintenance.job Automatic Full Backup.job Easy Internet Sign-up.job Norton AntiVirus - Scan my computer - Owner.job Norton AntiVirus - Scan my computer.job PCHealth Scheduler for Data Collection.job Symantec NetDetect.job Tune-up Application Start.job -------------------------------------------------- Enumerating Download Program Files: [{FFA6CE4C-2199-4A4F-9542-12E0163D6841}] CODEBASE = http://sessa.isprime.com:8080/tel2net/CABDialer.cab -------------------------------------------------- Enumerating Windows NT/2000/XP services AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (autostart) Aspi32: System32\drivers\aspi32.sys (autostart) ATM Call Manager: System32\DRIVERS\atmuni.sys (autostart) Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart) Symantec Settings Manager: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart) Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart) Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Event Log: %SystemRoot%\system32\services.exe (autostart) Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart) mdmxsdk: System32\DRIVERS\mdmxsdk.sys (autostart) Norton AntiVirus Auto Protect Service: "C:\Program Files\Norton AntiVirus\navapsvc.exe" (autostart) Norton Unerase Protection: C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (autostart) NVIDIA Display Driver Service: %SystemRoot%\System32\nvsvc32.exe (autostart) Plug and Play: %SystemRoot%\system32\services.exe (autostart) IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart) Protected Storage: %SystemRoot%\system32\lsass.exe (autostart) RAW WAN Driver: System32\DRIVERS\rawwan.sys (autostart) Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart) Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart) SAVScan: C:\Program Files\Norton AntiVirus\SAVScan.exe (autostart) ScriptBlocking Service: C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart) Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart) System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Symantec Core LC: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (autostart) symlcbrd: \??\C:\WINDOWS\System32\drivers\symlcbrd.sys (autostart) SYMTDI: \??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS (autostart) Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Upload Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) vsdatant: \??\C:\WINDOWS\System32\vsdatant.sys (autostart) TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart) Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart) Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart) Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart) Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\System32\webcheck.dll SysTray: C:\WINDOWS\System32\stobject.dll -------------------------------------------------- End of report, 12,514 bytes Report generated in 0.172 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
|
#18
July 16th, 2004, 06:06 AM
|
||||
|
||||
|
Re: rundll32.exe
“you can't wait too long tho' for the rest - or you will likely re-infect”
I’m a bit concerned that, after supplying you with the logs you asked for, I haven’t yet been advised if they’re OK or otherwise, especially after what you said (above) in your previous post?
__________________
"The guitar's all right as a hobby, John, but you'll never make a living out of it" |
| « Previous Thread | Next Thread » |
| Thread Tools | Search this Thread |
|
|
