Trojan.ByteVerify

Hi All:

First a big thank you to Mr Pieter Arntz for providing the link to Hijack This.

My situation is as follows. Yesterday I ran a full scan of my computer using Norton AV Pro 2003 and in My Documents and Settings folder (in Win2K) it found and automatically deleted a nasty called Trojan.ByteVerify.

A little later in the day I noticed that 4 services I disabled on November 29th had been re-enabled. Very suspicious was the fact that Remote Registry Service (which I've since re-disabled) had been switched back to Automatic. I'm left wondering whether it was my uninvited visitor, or some other that I've yet to discover, could have done this, and what other funny business they may have been up to behind my back.

I just ran Hijackand here is a copy of the log:

Logfile of HijackThis v1.97.7
Scan saved at 12:56:01 AM, on 12/1/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\pupxpman.exe
C:\Program Files\TDS3\TDS-3.exe
C:\Program Files\Invention Pilot\Tray Pilot Lite\TrayPlt.exe
C:\PROGRA~1\CACHEMAN\Cacheman.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Disk Tray\DiskTray.exe
C:\Program Files\SysInfoMyWork\SysInfoMyWork.exe
C:\Program Files\Iarsn\TaskInfo2000 2.2b3\TaskInfo.exe
C:\Program Files\ashampoo\Ashampoo UnInstaller Suite\UIWatcher.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\msagent\AgentSvr.exe
C:\PROGRA~1\Netscape\Netscape\Netscp.exe
C:\WINNT\system32\ntvdm.exe
C:\Program Files\HIJACK\HIJACKTH.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
N3 - Netscape 7: user_pref("browser.startup.homepage", ""); (C:\Documents and Settings\Tony Saroop\Application Data\Mozilla\Profiles\default\81mpn8xg.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Tony Saroop\Application Data\Mozilla\Profiles\default\81mpn8xg.slt\prefs.js)
O1 - Hosts: 203.161.127.141 www.dcsresearch.com
O2 - BHO: Bugnosis - {3A6514CD-A457-11D4-8AF3-000102686B79} - C:\Program Files\Bugnosis\WebBug.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Bugnosis - {930E4DE1-973D-42D6-BF6E-6788E06BD003} - C:\Program Files\Bugnosis\WebBug.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [mspwr] C:\WINNT\system32\pupxpman.exe
O4 - HKLM\..\Run: [PwrUpTweakMe] C:\WINNT\system32\PUPXPTWK.EXE /TWEAK
O4 - HKLM\..\Run: [TDS3] C:\Program Files\TDS3\TDS-3.exe
O4 - HKCU\..\Run: [Tray Pilot Lite] "C:\Program Files\Invention Pilot\Tray Pilot Lite\TrayPlt.exe"
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\CACHEMAN\Cacheman.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - Startup: Disk Tray.lnk = C:\Program Files\Disk Tray\DiskTray.exe
O4 - Startup: SysInfoMyWork.lnk = C:\Program Files\SysInfoMyWork\SysInfoMyWork.exe
O4 - Startup: TaskInfo.lnk = C:\Program Files\Iarsn\TaskInfo2000 2.2b3\TaskInfo.exe
O4 - Startup: UIWatcher.exe.lnk = C:\Program Files\ashampoo\Ashampoo UnInstaller Suite\UIWatcher.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'awlsp21.dll' missing
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37906.0671990741
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup132.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab

I'd very much appreciate it if one of the resident experts at this marvelous site would take a look at this log and let me know if there's anything suspicious I ought to delete.

Cheers,

tepi.

 

Hi tepi,

One very suspicious entry in your log:
O4 - HKLM\..\Run: [mspwr] C:\WINNT\system32\pupxpman.exe

Have HijackThis Fix that entry and send the file to the address in my profile please.
I'll keep you posted on it's nature.

Regards,

Pieter

 

Hi Pieter:

Thank you. Will do.

Cheers,

tepi.