Casino Palazzo

Discussion in 'adware, spyware & hijack cleaning' started by JMarty, Jun 9, 2004.

Thread Status:
Not open for further replies.
  1. JMarty

    JMarty Registered Member

    Joined:
    Jun 9, 2004
    Posts:
    4
    OK, bear with me. I've never used a forum or IM, so I hope that I can figure out how to reaccess this forum later.

    I have just received a used Sony VAIO PCG-F390 laptop from my family. I wiped it and reinstalled, retaining Wdws 98. I accessed the Internet before installing all of my utilities and AV programs and obviously not yet installed Spybot or SpywareBlasters.


    Bottom line: I picked up some sort of malware, parasite, or something. Even though I don't use IE except occasionally, when I boot up it tries to launch IE to a site called CasnoPalazzo.com. I ordinarily use Mozilla. This Casino Palazzo always re-Places an icon named "Sex" on my desktop and reinstalls.

    I have run AdAware, ZoneAlarm, Spybot, SpywareBlaster, Norton Utilities and AV, etc. to no avail. I have tried to delete all temporary and Internet content files. This is so annoying even though I seldom use IE. Does anyone have suggestions before I re-reload the whole computer, that takes SO long to reload, download, and reconfigure, and this could just happen again if I don't load the protection before the Internet access.
     
  2. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi JMarty, and welcome to Wilders.

    I have moved your post out of the Test forum and into this one where it will receive better attention.

    Please follow the steps here: https://www.wilderssecurity.com/showthread.php?t=15913

    Then once you have downloaded HijackThis, create a new, permanent folder on your C drive and unzip Hijackthis.exe into the new folder. Run the program, then when the scan is finished, the "Scan" button will then change to a "Save Log" button. Press the "Save Log" button.

    Copy and paste the entire contents of the hijackthis log here in this thread.

    NOTE: Most of what it lists will be harmless and even essential - so, do NOT fix anything yet. Someone will review your log and give you instructions on what needs to be fixed.

    Regards,

    snap
     
  3. JMarty

    JMarty Registered Member

    Joined:
    Jun 9, 2004
    Posts:
    4
    Re: Casino Palazzo HiJackthis.log

    Logfile of HijackThis v1.97.7
    Scan saved at 12:47:07 AM, on 6/9/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\EASY INTERNET\ENCMONTR.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\APOINT\APOINT.EXE
    C:\WINDOWS\SYSTEM\IRMON.EXE
    C:\PROGRAM FILES\SONY\1394\SCMON.EXE
    C:\WINDOWS\SYSTEM\PELMICED.EXE
    C:\PROGRAM FILES\SONY\SMART LABEL\SSLFVIEW.EXE
    C:\PROGRAM FILES\SONY\HOTKEY UTILITY\HKSERV.EXE
    C:\WINDOWS\DSLAUNCH.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
    C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
    C:\WINDOWS\RunDLL.exe
    C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUNOTIFY.EXE
    C:\PROGRAM FILES\BATTERYSCOPE\BATMGR.EXE
    C:\PROGRAM FILES\APOINT\APWHEEL.EXE
    C:\PROGRAM FILES\POWERPANEL\PROGRAM\PCFMGR.EXE
    C:\PROGRAM FILES\SONY\PPK SETUP\SESERVE.EXE
    C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
    C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
    C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\__DOWNLOADED\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://aifind.info/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.find-online.net/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.find-online.net/index.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie-search.com/home.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.info/
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [AlpsPoint] C:\Progra~1\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [IrMon] IrMon.exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Smart Connect Monitor] C:\Program Files\Sony\1394\SCMon.exe
    O4 - HKLM\..\Run: [Smart Connect Setup] C:\Program Files\Sony\1394\SCSetup.exe -c
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
    O4 - HKLM\..\Run: [Smart Label RFViewer] C:\PROGRA~1\SONY\SMARTL~1\SSLFVIEW.EXE
    O4 - HKLM\..\Run: [USB 3-D Mouse] 3dmoused.exe
    O4 - HKLM\..\Run: [HKserv.exe] C:\Program Files\Sony\HotKey Utility\HKserv.exe
    O4 - HKLM\..\Run: [YAMAHA DS-XG Launcher] c:\windows\dslaunch.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Encompass_ENCMONTR] C:\Program Files\Easy Internet\ENCMONTR.EXE
    O4 - HKLM\..\RunServices: [WUSB54G.exe] C:\Program Files\WUSB54G Wireless-G Adapter\WUSB54G.exe
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [CSINJECT.EXE] c:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
    O4 - HKLM\..\RunServices: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
    O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
    O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
    O4 - HKCU\..\Run: [HKserv.exe] C:\Program Files\Sony\HotKey Utility\HKserv.exe
    O4 - HKCU\..\Run: [sex] C:\WINDOWS\sexxx.exe
    O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
    O4 - HKCU\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
    O4 - Startup: BatteryScope.lnk = C:\Program Files\BatteryScope\batmgr.exe
    O4 - Startup: PowerPanel.lnk = C:\Program Files\PowerPanel\PROGRAM\PcfMgr.exe
    O4 - Startup: PPK Setup(Server).lnk = C:\Program Files\Sony\PPK Setup\SEServe.exe
    O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38140.5116898148
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Re: Casino Palazzo HiJackthis.log

    Hi JMarty,

    Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://aifind.info/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.find-online.net/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.find-online.net/index.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie-search.com/home.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.info/

    O4 - HKCU\..\Run: [sex] C:\WINDOWS\sexxx.exe

    O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm

    O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
    O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe

    Download and run: http://www.spywareinfoforum.com/~merijn/files/CWShredder.exe
    Use the Fix button and follow the instructions you will receive.

    Then reboot into safe mode and delete:
    C:\WINDOWS\sexxx.exe

    Regards,

    Pieter
     
  5. JMarty

    JMarty Registered Member

    Joined:
    Jun 9, 2004
    Posts:
    4
    Snapdragin (& Pieter Arndt),

    In re: Casino Palazzo problem

    I did not know who you are and I was desperate. I dearly thank you for your kindness and help. It saved me a lot of time and frustration. I am currently unemployed and truly appreciate not having to spend time around this.

    It took me a bit of trust to blindly follow instructions from somewhere in cyberspace and download two programs and follow on faith; something I am not used to doing out in the Internet.

    Your directions were clear and precise. There were no questions left and they worked perfectly. I like to think I can also 'Pay It Forward' when doing acts of selflessness. Thank you, for keeping my faith in others' generousity and help.

    Joel Marty
    Minneapolis, MN

    copy also to Pieter Arndt
     
  6. JMarty

    JMarty Registered Member

    Joined:
    Jun 9, 2004
    Posts:
    4
    Re: Casino Palazzo HiJackthis.log

    Pieter Arndt (& Snapdragin),

    In re: Casino Palazzo problem

    I did not know who you are and I was desperate. I dearly thank you for your kindness and help. It saved me a lot of time and frustration. I am currently unemployed and truly appreciate not having to spend time around this.

    It took me a bit of trust to blindly follow instructions from somewhere in cyberspace and download two programs and follow on faith; something I am not used to doing out in the Internet.

    Your directions were clear and precise. There were no questions left and they worked perfectly. I like to think I can also 'Pay It Forward' when doing acts of selflessness. Thank you, for keeping my faith in others' generousity and help.

    Joel Marty
    Minneapolis, MN

    copy also to Snapdragin
     
  7. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi JMarty,

    Thank you for your kind words. :) Yes, it can be difficult to give blind trust to those you don't know, but if it is any assurance, Pieter is known on just about every security board on the internet for his expertise in this area, and he would never steer anyone wrong. You are in the best of hands with his advice. ;)

    Please do post another hijackthis log here, so he can check it and make sure it is clean of any infection.

    Kindest regards,

    snap
     
Thread Status:
Not open for further replies.