rundll32.exe

Discussion in 'adware, spyware & hijack cleaning' started by ArthurLee, Jul 10, 2004.

Thread Status:
Not open for further replies.
  1. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    This doesn't appear to be life threatening but it's one of those annoying little things. For some reason (and this only started yesterday), whenever I close down my PC - ie clicking Start>Turn Off Computer, I get an annoying pop up box 'End Program - rundll32.exe' and I have to wait until the blue progress bar gets to the end after which, I get the message 'Ending program, please wait ...........' and I get the choice to click either 'End now' or 'Cancel'. If I click 'End now', the PC shuts down and if I click 'Cancel', it just goes back to my desktop.

    It's really annoying and it's never happened before.

    Any ideas. Help much appreciated. o_O
     
  2. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    Post the scan log from HijackThis
    Unzip it somewhere to keep and run hijackthis.exe - press Scan - the Scan button changes to a Save Log button
    Save, and then copy and paste the entire log here.
    Dont' choose to fix anything yet - most entries will be harmless
     
  3. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Here's my HT log. It's really weird because I ran a virus scan whigh picked up around 24 'threats' (no infecred items) but when I ran Spybot and Adaware, the Spybot found nothing and the Adaware found 3 registry entrys which were removed. After my HT log, I've provided a list of what my AV program discovered. Incidentally, only 4 items could be removed. Do you think I should manually delete the rest? Why didn't Adaware pick these up? Thanks for looking at this :

    Logfile of HijackThis v1.97.3
    Scan saved at 21:09:59, on 10/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe
    C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\hudelr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Owner\Application Data\eber.exe
    C:\WINDOWS\System32\NDrv.exe
    C:\WINDOWS\System32\wcpsvsu.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\Program Files\Mozilla Thunderbird\thunderbird.exe
    C:\Program Files\Norton AntiVirus\OPScan.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\MICHAEL'S STUFF\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freeserve.com/
    R3 - URLSearchHook: (no name) - - (no file)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
    O4 - HKLM\..\Run: [gbgqnawesh] C:\WINDOWS\System32\hudelr.exe
    O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\eber.exe
    O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe
    O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpsvsu.exe
    O4 - Startup: Calendar.lnk = C:\Program Files\Calendar\cal.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0A6195BD-5E98-44CA-8FC9-62F3F5978C08}: NameServer = 195.92.195.94 195.92.195.95

    Log of AV report :

    ,Threat category: AdwareSource: C:\WINDOWS\twaintec.dll,Description: The file C:\WINDOWS\twaintec.dll is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\system32\wcpsvsu.exe,Description: The file C:\WINDOWS\system32\wcpsvsu.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\system32\jao.dll,Description: The file C:\WINDOWS\system32\jao.dll is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\system32\deluxnetwork.exe,Description: The file C:\WINDOWS\system32\deluxnetwork.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\system32\bridge.dll,Description: The file C:\WINDOWS\system32\bridge.dll is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\system32\a.exe,Description: The compressed file a.exe within C:\WINDOWS\system32\a.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\system32\a.exe,Description: The file C:\WINDOWS\system32\a.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\preInsTT.exe,Description: The file C:\WINDOWS\preInsTT.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\mxTarget.dll,Description: The file C:\WINDOWS\mxTarget.dll is a Adware threat.
    ,Threat category: AdwareSource: C:\WINDOWS\iNetPal\m3tsp8.exe,Description: The file C:\WINDOWS\iNetPal\m3tsp8.exe is a Adware threat.
    ,Threat category: Hack toolSource: C:\Program Files\Norton AntiVirus\keygen.exe,Description: The file C:\Program Files\Norton AntiVirus\keygen.exe is a Hack tool threat.
    ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THID7F.tmp\mxTarget.dll,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THID7F.tmp\mxTarget.dll is a Adware threat.
    ,Threat category: AdwareSource: mxTarget.dll,Description: The compressed file mxTarget.dll within C:\Documents and Settings\Owner\Local Settings\Temp\THID7F.tmp\mxTarget.cab is a Adware threat.
    ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.dll,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.dll is a Adware threat.
    ,Threat category: AdwareSource: polall1t.exe,Description: The compressed file polall1t.exe within polall1t.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat.
    ,Threat category: AdwareSource: polall1t.exe,Description: The compressed file polall1t.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat.
    ,Threat category: AdwareSource: preInsTT.exe,Description: The compressed file preInsTT.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat.
    ,Threat category: AdwareSource: twaintec.dll,Description: The compressed file twaintec.dll within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\twaintec.cab is a Adware threat.
    ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\preInsTT.exe,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\preInsTT.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe,Description: The compressed file polall1t.exe within C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe,Description: The file C:\Documents and Settings\Owner\Local Settings\Temp\THI1135.tmp\polall1t.exe is a Adware threat.
    ,Threat category: AdwareSource: C:\Documents and Settings\Owner\Application Data\eber.exe,Description: The file C:\Documents and Settings\Owner\Application Data\eber.exe is a Adware threat.
     
  4. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    I would have preferred you to use the much newer version of HJT which I linked above

    Use Taskmanager (Ctrl-Alt-Del) to end these running processes if you can
    (or use Process Explorer)

    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\hudelr.exe
    C:\Documents and Settings\Owner\Application Data\eber.exe
    C:\WINDOWS\System32\wcpsvsu.exe


    You could try the uninstaller at http://www.purityscan.com/uninstall.html
    (but I can't vouch for it)

    Empty the TIF (Temporary Internet Files)
    To do so use Control Panel > Internet Options(or right click the IE icon on the desktop and choose Properties)
    Click Delete Files on the General Tab - place a check in the Delete all offline content box and then press OK

    Delete all the files in (and any subfolders of) the C:\Windows\Temp\ folder


    Run HijackThis again, push Scan and place a check mark next to the following items using your mouse.
    Next, close all browser Windows, and push the 'Fix checked' button in HijackThis

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R3 - URLSearchHook: (no name) - - (no file)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
    O4 - HKLM\..\Run: [gbgqnawesh] C:\WINDOWS\System32\hudelr.exe
    O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\eber.exe
    O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpsvsu.exe


    Reboot

    Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/
    After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions.
    Now do the following:
    - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
    check: "Unload recognized processes during scanning."
    - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
    Check: "Let Windows remove files in use after reboot."

    Press "Scan Now"
    - Check option "Use Custom scanning options"
    - Check option "Activate In-Depth Scan"
    - Press "Select drives\folders to scan"
    - Select the active partition which is usually C:

    Now press "Next" to let Ad-aware scan your drives...
    It will find a number of "bad" files and registry keys.
    Right-click in that pane and choose "select all"

    Now press "Next" again.
    It will ask you whether you'd like to remove all checked items. Click OK.

    Finally, close Ad-Aware, and reboot.

    -----
    Delete the following file(s):
    C:\Documents and Settings\Owner\Application Data\eber.exe
    C:\WINDOWS\System32\wcpsvsu.exe
    C:\WINDOWS\System32\bridge.dll
    C:\WINDOWS\System32\hudelr.exe



    ------ some partial info (for further cleanup)
    http://www.kephyr.com/spywarescanner/library/purityscan.b/index.phtml



    ----
    Post a fresh log when you're done
     
  5. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Followed your instructions and when I went to close down (to reboot) the annoying 'end program - rundll32.exe' did not appear. Thank you so much. You're a star! Here's my current HT log (from the version you linked to!!). I hope it's OK now. Maybe you can let me know? I still can't figure out why Adaware & Spybot didn't pick up all those files that my AV application did.

    Thanks again.

    Logfile of HijackThis v1.98.0
    Scan saved at 22:36:47, on 10/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe
    C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\MICHAEL'S STUFF\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freeserve.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Calendar.lnk = C:\Program Files\Calendar\cal.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0A6195BD-5E98-44CA-8FC9-62F3F5978C08}: NameServer = 195.92.195.94 195.92.195.95

    :)
     
  6. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    There are indications of further problems
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

    Download FindnFix http://downloads.subratam.org/FINDnFIX.exe

    Double Click on the FindnFix.exe you downloaded earlier and it will install into its own folder.
    That folder should be C:\FINDnFIX
    Browse to the folder
    Close all other open windows.
    Run (double click on) the !LOG!.bat file

    Have a coffee

    When it's done:
    From the FindnFix folder.
    - Post (paste) the contents of Log.txt in this thread.
     
  7. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Well. it didn't take long to run. Barely had time to fill the kettle! Never used FINDnFIX before so I'm not sure how it should look. Here's the log.txt. Is everything OK?


    »»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»»
    »»»»»»»»»»»»»»»»»»*** Read this first! ***»»»»»»»»»»»»»»»»
    Due to errors on various message boards I made some changes.
    You must know how to ID the file based on the filters provided in
    the scan, as not all the files flagged are bad.
    If you make a mistake or use the wrong guidance, it is completely
    your responsibility and the helper that assists you.
    If you are not sure about the nature of the file or how
    to proceed, I suggest you research it first before attempting
    to remove any *unknown file on your own.
    *For Helpers and/or users that are not familiar with any of the
    items on the scan results- I recommend using an alternative, once
    you know what to look for!
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    --The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder
    and is the destination for the file to be moved..
    -*Previous directions will no longer work...
    »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»

    Microsoft Windows XP [Version 5.1.2600]
    »»»IE build and last SP(s)
    6.0.2800.1106 SP1-Q330994-Q824145-Q828750-Q832894-Q837009-Q831167
    The type of the file system is NTFS.
    C: is not dirty.

    11/07/2004
    6:12pm up 0 days, 0:12

    »»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/:cool:»»»»»»»»»»»»»»»»

    Scanning for file(s)...
    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
    »»»»» (*1*) »»»»» .........
    »»Locked or 'Suspect' file(s) found...

    C:\WINDOWS\System32\MS.DLL +++ File read error
    \\?\C:\WINDOWS\System32\MS.DLL +++ File read error

    »»»»» (*2*) »»»»»........
    **File C:\FINDnFIX\LIST.TXT
    MS.DLL Can't Open!

    »»»»» (*3*) »»»»»........

    C:\WINDOWS\SYSTEM32\
    ms.dll Mon 31 May 2004 10:07:10 A...R 57,344 56.00 K
    nticdm~1.dll Sat 29 May 2004 23:37:58 ...HR 116 0.11 K

    2 items found: 2 files (1 H/S), 0 directories.
    Total of file sizes: 57,460 bytes 56.11 K

    unknown/hidden files...

    C:\WINDOWS\SYSTEM32\
    nticdm~1.dll Sat 29 May 2004 23:37:58 ...HR 116 0.11 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 116 bytes 0.11 K

    »»»»» (*4*) »»»»».........
    Sniffing..........
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\MS.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\NTICDM~1.DLL

    »»»»»(*5*)»»»»»
    **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT
    ¯ Access denied ® ..................... MS.DLL .....57344 31.05.2004

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
    »»»»»Search by size...


    C:\WINDOWS\SYSTEM32\
    ms.dll Mon 31 May 2004 10:07:10 A...R 57,344 56.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 57,344 bytes 56.00 K

    No matches found.

    No matches found.

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\MS.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.


    »»Size of Windows key:
    (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

    Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 0

    »»Dumping Values........


    »»Security settings for 'Windows' key:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!


    Can't open Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:

    2 - The system cannot find the file specified.
    »»Member of...: (Admin logon required!)
    User is a member of group MICHAEL\None.
    User is a member of group \Everyone.
    User is a member of group BUILTIN\Administrators.
    User is a member of group BUILTIN\Users.
    User is a member of group \LOCAL.
    User is a member of group NT AUTHORITY\INTERACTIVE.
    User is a member of group NT AUTHORITY\Authenticated Users.


    »»»»»»Backups created...»»»»»»
    6:12pm up 0 days, 0:13
    11/07/2004

    File not found - key*.hiv
    File not found - keys1\winkey.reg

    C:\FINDNFIX\
    JUNKXXX Sun 11 Jul 2004 7:32:32 .D... <Dir>

    1 item found: 0 files, 1 directory.

    »»Performing string scan....
    ERROR: failed to open file
    --------------
    --------------
    No matching files were found.

    --------------
    --------------
    Error: Couldn't open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
     
  8. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    It shouldn't look like that if you are clean!
    Here they've 'removed' the entire
    hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    key which is showing size 0

    It might take me a bit to research this one
    (btw - C:\WINDOWS\System32\MS.DLL is NOT a standard microsoft file but 57,460 is 'in the ballpark' for CWS)
    It might be something else.
     
    Last edited: Jul 11, 2004
  9. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    I've ran Adaware, Spybot (Search & Destroy) and CWS Shredder and nothing has been discovered. The original problem I had has been fixed though ie the box with 'End program - rundll32.exe' doesn't appear when I close down my PC.

    Although I'm not quite clean, I'll await your findings and/or instructions following your further research.
     
  10. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    I hate to put you through more stuff - but
    Can you download http://download.broadbandmedic.com/VX2Finder(126).exe

    Press the Click to Find VX2 Betterinternet Button at the bottom.
    Click the Make Log Button.
    Copy and paste the contents of the log which will open into your next reply here.
     
  11. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Thanks. Actually, I don’t mind doing all this if the result is that my machine is clean at the end of it. It’s also a learning curve for myself. I’ve learned quite a bit from this experience. I’m at work right now but when I get home tonight, I’ll post the log from the downloaded application.
     
  12. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Well. IMM, here's the log as promised. Hope everythings OK?

    Log for VX2.BetterInternet File Finder (msg126)

    Files Found---

    Additional Files---

    Keys Under Notify---crypt32chain
    Keys Under Notify---cryptnet
    Keys Under Notify---cscdll
    Keys Under Notify---igfxcui
    Keys Under Notify---ScCertProp
    Keys Under Notify---Schedule
    Keys Under Notify---sclgntfy
    Keys Under Notify---SensLogn
    Keys Under Notify---termsrv
    Keys Under Notify---wlballoon


    Guardian Key--- is called:

    User Agent String---
    CDSource=ALLIED_01_01 IEAK
     
  13. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    This one is going to be a pain :(

    I think we really need to delete the
    C:\WINDOWS\SYSTEM32\MS.DLL
    file first, and do the rest of the cleanup after.
    (you can't wait too long tho' for the rest - or you will likely re-infect

    You could first try booting to SAFE mode and deleting the file
    How to start the computer in Safe mode
    If this works great!

    Follow up with CWShredder and a fully updated Ad-Aware!

    If this fails I thinkwe'll end up using a recovery console
    http://www.windows-help.net/WindowsXP/howto-12.html

    This is very DOS like and you may need to have someone familiar with it help you
     
    Last edited: Jul 12, 2004
  14. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Sorry to be such a pain! Although I'm following your instructions to the letter, I'm a bit concerned as to how much my system is infected. Reading between the lines, if I successfully get rid of the \WINDOWS\SYSTEM32\MS.DLL file, it looks like I may be re-infected if I don't act quickly to clean up more stuff? I'll try and remove the file tonight and get back to you.
     
  15. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    OK. I finally managed to delete MS.DLL from my system. I didn't know what you meant by 'comf.dll' or where to find it. What I did was rename MS.DLL then move the file to another folder. I then deleted it successfully. Ran a search for both the MS.DLL & renamed file and didn't find anything. What's the next step in the cleaning process?

    Thanks.
     
  16. IMM

    IMM Spyware Fighter

    Joined:
    May 6, 2004
    Posts:
    351
    Sorry about comf - should have read ms.dll
    I reuse text and forgot to modify a bit there :(

    Post a fresh HJT log file

    Additionally, post the StartupList log.
    In HJT use Config > Misc Tools, put a check in "show minor sections" and then click "Generate Startuplist".


    -----------
    Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/
    After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions.
    Now do the following:
    - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
    check: "Unload recognized processes during scanning."
    - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
    Check: "Let Windows remove files in use after reboot."

    Press "Scan Now"
    - Check option "Use Custom scanning options"
    - Check option "Activate In-Depth Scan"
    - Press "Select drives\folders to scan"
    - Select the active partition which is usually C:

    Now press "Next" to let Ad-aware scan your drives...
    It will find a number of "bad" files and registry keys.
    Right-click in that pane and choose "select all"

    Now press "Next" again.
    It will ask you whether you'd like to remove all checked items. Click OK.

    Finally, close Ad-Aware, and reboot.
     
  17. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    Here we are then. Adaware actually found only 2 suspect files (both identical) as follows which I promptly removed :

    Possible browser hijack attempt : Software\Netscape\Netscape Navigator\Automation Protocolshttpdapns

    Unknown Object recognized!
    Type : RegData
    Data : "DAPNS.Protocol.1"
    Rootkey : HKEY_CURRENT_USER
    Object : Software\Netscape\Netscape Navigator\Automation Protocols
    Value : http
    Data : "DAPNS.Protocol.1"

    My Hijackthis & Startuplist logs follow. I'm hoping we're a bit nearer to total clenliness!?

    Logfile of HijackThis v1.98.0
    Scan saved at 15:51:27, on 14/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe
    C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\MICHAEL'S STUFF\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.freeserve.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freeserve.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Calendar.lnk = C:\Program Files\Calendar\cal.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {FFA6CE4C-2199-4A4F-9542-12E0163D6841} - http://sessa.isprime.com:8080/tel2net/CABDialer.cab

    _________________________________________________________________

    StartupList report, 14/07/2004, 15:57:15
    StartupList version: 1.52.2
    Started from : C:\MICHAEL'S STUFF\HijackThis.EXE
    Detected: Windows XP SP1 (WinNT 5.01.2600)
    Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    * Using default options
    * Showing rarely important sections
    ==================================================

    Running processes:

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\HP\KBD\KBD.EXE
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe
    C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\MICHAEL'S STUFF\HijackThis.exe

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Startup:
    [C:\Documents and Settings\Owner\Start Menu\Programs\Startup]
    Calendar.lnk = C:\Program Files\Calendar\cal.exe
    SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

    Shell folders Common Startup:
    [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
    HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe

    --------------------------------------------------

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    hpsysdrv = c:\windows\system\hpsysdrv.exe
    HPHUPD05 = c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    HPHmon05 = C:\WINDOWS\System32\hphmon05.exe
    KBD = C:\HP\KBD\KBD.EXE
    UpdateManager = "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    Recguard = C:\WINDOWS\SMINST\RECGUARD.EXE
    PS2 = C:\WINDOWS\system32\ps2.exe
    NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    nwiz = nwiz.exe /installquiet /keeploaded /nodetect
    AlcxMonitor = ALCXMNTR.EXE
    NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
    AdaptecDirectCD = "C:\Program Files\Roxio\WinOnCD\DirectCD\DirectCD.exe"
    TIxDSL = C:\PROGRA~1\FREESE~1\bin\win2k\tidslmon.exe -b
    ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    Advanced Tools Check = C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    Device Detector = "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    --------------------------------------------------

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    Acme.PCHButton = C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe
    MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

    --------------------------------------------------

    Enumerating Active Setup stub paths:
    HKLM\Software\Microsoft\Active Setup\Installed Components
    (* = disabled by HKCU twin)

    [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

    [>{26923b43-4d38-484f-9b9e-de460746276c}] *
    StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

    [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
    StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

    [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
    StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

    [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

    [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
    StubPath = regsvr32.exe /s /n /i:U shell32.dll

    [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
    StubPath = %SystemRoot%\system32\ie4uinit.exe

    [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
    StubPath = C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install

    --------------------------------------------------

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=*INI section not found*
    SCRNSAVE.EXE=*INI section not found*
    drivers=*INI section not found*

    Shell & screensaver key from Registry:

    Shell=Explorer.exe
    SCRNSAVE.EXE=C:\WINDOWS\System32\scrnsave.scr
    drivers=*Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: Shell=*Registry key not found*
    HKLM\..\Policies: Shell=*Registry value not found*

    --------------------------------------------------

    Checking for EXPLORER.EXE instances:

    C:\WINDOWS\Explorer.exe: PRESENT!

    C:\Explorer.exe: not present
    C:\WINDOWS\Explorer\Explorer.exe: not present
    C:\WINDOWS\System\Explorer.exe: not present
    C:\WINDOWS\System32\Explorer.exe: not present
    C:\WINDOWS\Command\Explorer.exe: not present
    C:\WINDOWS\Fonts\Explorer.exe: not present

    --------------------------------------------------

    Checking for superhidden extensions:

    .lnk: HIDDEN! (arrow overlay: yes)
    .pif: HIDDEN! (arrow overlay: yes)
    .exe: not hidden
    .com: not hidden
    .bat: not hidden
    .hta: not hidden
    .scr: not hidden
    .shs: HIDDEN!
    .shb: HIDDEN!
    .vbs: not hidden
    .vbe: not hidden
    .wsh: not hidden
    .scf: HIDDEN! (arrow overlay: NO!)
    .url: HIDDEN! (arrow overlay: yes)
    .js: not hidden
    .jse: not hidden

    --------------------------------------------------

    Enumerating Browser Helper Objects:

    (no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}
    NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    1-Click Maintenance.job
    Automatic Full Backup.job
    Easy Internet Sign-up.job
    Norton AntiVirus - Scan my computer - Owner.job
    Norton AntiVirus - Scan my computer.job
    PCHealth Scheduler for Data Collection.job
    Symantec NetDetect.job
    Tune-up Application Start.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [{FFA6CE4C-2199-4A4F-9542-12E0163D6841}]
    CODEBASE = http://sessa.isprime.com:8080/tel2net/CABDialer.cab

    --------------------------------------------------

    Enumerating Windows NT/2000/XP services

    AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (autostart)
    Aspi32: System32\drivers\aspi32.sys (autostart)
    ATM Call Manager: System32\DRIVERS\atmuni.sys (autostart)
    Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart)
    Symantec Settings Manager: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart)
    Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
    DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
    Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Event Log: %SystemRoot%\system32\services.exe (autostart)
    Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
    mdmxsdk: System32\DRIVERS\mdmxsdk.sys (autostart)
    Norton AntiVirus Auto Protect Service: "C:\Program Files\Norton AntiVirus\navapsvc.exe" (autostart)
    Norton Unerase Protection: C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (autostart)
    NVIDIA Display Driver Service: %SystemRoot%\System32\nvsvc32.exe (autostart)
    Plug and Play: %SystemRoot%\system32\services.exe (autostart)
    IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
    Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
    RAW WAN Driver: System32\DRIVERS\rawwan.sys (autostart)
    Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
    Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
    SAVScan: C:\Program Files\Norton AntiVirus\SAVScan.exe (autostart)
    ScriptBlocking Service: C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)
    Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
    Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
    System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Symantec Core LC: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (autostart)
    symlcbrd: \??\C:\WINDOWS\System32\drivers\symlcbrd.sys (autostart)
    SYMTDI: \??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS (autostart)
    Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
    Upload Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    vsdatant: \??\C:\WINDOWS\System32\vsdatant.sys (autostart)
    TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
    Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
    Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
    Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
    Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)


    --------------------------------------------------

    Enumerating ShellServiceObjectDelayLoad items:

    PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
    WebCheck: C:\WINDOWS\System32\webcheck.dll
    SysTray: C:\WINDOWS\System32\stobject.dll

    --------------------------------------------------
    End of report, 12,514 bytes
    Report generated in 0.172 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
     
  18. ArthurLee

    ArthurLee Registered Member

    Joined:
    Jun 4, 2004
    Posts:
    29
    “you can't wait too long tho' for the rest - or you will likely re-infect”

    I’m a bit concerned that, after supplying you with the logs you asked for, I haven’t yet been advised if they’re OK or otherwise, especially after what you said (above) in your previous post?
     
Thread Status:
Not open for further replies.