new here. help with virus..

Discussion in 'adware, spyware & hijack cleaning' started by rsxtreme, May 21, 2004.

Thread Status:
Not open for further replies.
  1. rsxtreme

    rsxtreme Registered Member

    Joined:
    May 21, 2004
    Posts:
    28
    eh i posted in the wrong place.. i think this is the right place..
    well...i caught a virus this morning ..some trojan dialer.. avg took care of it..
    now i ran adaware to check for spyware.. and avg pops up with "java/byteverify virus".. i run avg and it dont even show up.. help?..

    here is my scan..
    Logfile of HijackThis v1.97.7
    Scan saved at 7:41:37 PM, on 5/21/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\WINDOWS\LTMSG.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\Grisoft\AVG6\avgcc32.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\Winamp\Winampa.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\interMute\SpamSubtract\SpamSub.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    c:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Owner\Desktop\****\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: AIM (HKLM)
    O10 - Broken Internet access because of LSP provider 'spsublsp.dll' missing
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/...director/sw.cab
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/...nfo/webscan.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pu...ash/swflash.cab
     
  2. rsxtreme

    rsxtreme Registered Member

    Joined:
    May 21, 2004
    Posts:
    28
  3. rsxtreme

    rsxtreme Registered Member

    Joined:
    May 21, 2004
    Posts:
    28
    :doubt: need help..
     
  4. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi rsxtreme, and welcome.

    Since there are a few issues in your log that needs to be looked at, I will move it over to our adware/spyware/hijack cleaning forum where an Expert will review it and reply with instructions for you.

    Regards,

    snap
     
  5. rsxtreme

    rsxtreme Registered Member

    Joined:
    May 21, 2004
    Posts:
    28
    thanks.. can you give me details on the few things that are needed to be looked at..
     
  6. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi rsxtreme,

    There is only one of me at the moment, and our Experts come on a bit later (different time zones involved) and there are quite a few more logs ahead of your's where people have been waiting patiently.

    But do not worry, we will get to your's as soon as possible. Thank you for your patience.

    Regards,

    snap
     
  7. rsxtreme

    rsxtreme Registered Member

    Joined:
    May 21, 2004
    Posts:
    28
    thanks. but me being a dumbass . i didnt search.. so yeah. made dumb posts. i think i fixed it . but im not sure. i went into "C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache" and deleted the jar folder.. and ran adaware. the virus notification didnt show up.. im guessing problem solved? o_O
     
  8. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi there,
    You posted in the TDS forum too, i was not around before you posted this new thread (we could have easily moved it for you to spare you the reposting!, but sorry, time zones, i had to add some sleep to my to-do list as did others)
    so there i gave you some advices too.
    https://www.wilderssecurity.com/showthread.php?t=33214
    Depending on the next steps and your actions and wishes we'll decide later if we give you another run for your thread! :D
    At least the experts will get you clean!

    BTW: java/byteverify virus is not as much a virus as more an exploit; make sure in the meantime you have all your security patches for windows and internet explorer.
    http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=36651
     
    Last edited: May 22, 2004
  9. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi rsxtreme,

    This information on the AlcxMonitor is taken from Pac's Portal (Startup List)

    With only Hijackthis open, and ALL other browsers/windows closed, place a check beside the following and click *Fixed checked:

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

    Then reboot into safe mode and delete:
    ALCXMNTR.EXE <--- you will have to do a search for the file.

    Reboot your computer normally.


    This thread might be of some help for the Java.ByteVerify.exploit trojan that you said you are still getting alerts for:
    https://www.wilderssecurity.com/showthread.php?t=13039

    You do have some other unnecessary programs running at startup.
    To find out more about which one's are needed or not at startup, you can search them through either of these two sites:

    Answersthatwork
    Windows Startup On-line

    Regards,

    snap
     
    Last edited: May 23, 2004
Thread Status:
Not open for further replies.