|
| ||
| I need help removing Update.exe Spyware/Adware I am having trouble removing Update.exe Spyware/Adware. I don't know how it arrived ... I am very careful where I browse and what I download, but unfortunately, I am not the only one who uses this computer. I have provided some behavior details because I know there are many different Update.exe infections. Update.exe runs from registry key HKLM\..\Run: "C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe" te-110-12-0000213 I have used Ad-Aware SE by Lavasoft to remove Update.exe. It deletes the key and the file but they return on reboot. For a while Update.exe tried to connect to: http://dr32.mcboo.XXXX (com) It was prevented by my firewall and I blocked it but somehow, it must have connected somewhere. Now I am getting popup ads. I assume they are caused by Update.exe but I suppose it is possible that there are multiple problems. When I open a browser page for most any legitimate site, I get just 1, or sometimes many popups. They are usually content related. If I am on Google or browsing Download.com looking at Anti-Spyware or Anti-Virus items, I get a ton of popups related to Anti-Spyware/Anti-Virus. Sometimes though, I can browse for a long time with no popups. Sometimes It can seriously effect performance/stability but usually not. Popup ads are mostly from http://ad.oinadserver.XXXX/... (com). Here is my hijacklog, I hope it helps. Thanks to all who reads this. Kevin Fegan (P.S. I am aware of Gator/GMT but the ads I am seeing are not from Gator. I've been using Gator for a long time, without problems and I like it, and for now I am willing to put up with its occasional interruptions.) Logfile of HijackThis v1.99.1 Scan saved at 11:23:09 AM, on 1/5/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\svchosts.exe F:\Program Files\WS_FTP Pro\ftpsched.exe F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\navapsvc.exe F:\Program Files\Norton\SystemWorks2003\Norton Utilities\NPROTECT.EXE F:\PROGRA~1\Norton\SYSTEM~2\SPEEDD~1\nopdb.exe F:\PROGRA~1\ALLUME~1\StuffIt\MXTask.exe F:\PROGRA~1\ALLUME~1\StuffIt\mxtask.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\LMSXXD.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\WINDOWS\Mixer.exe C:\Program Files\Common Files\CMEII\CMESys.exe F:\Program Files\WS_FTP Pro\ftpqueue.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\System32\WNSXS~1\services.exe C:\PROGRA~1\COMMON~1\mwrk\mwrkm.exe C:\Program Files\??crosoft\?xplorer.exe F:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe F:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe F:\Program Files\eFax Messenger 4.0\J2GTray.exe C:\Program Files\Gator.com\Gator\Gator.exe F:\Program Files\Creative Element Power Tools\Startup.exe C:\Program Files\Common Files\GMT\GMT.exe F:\Program Files\Microsoft Office\Office\FINDFAST.EXE F:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\PROGRA~1\COMMON~1\mwrk\mwrka.exe J:\IBIN\A-Temp-17\Hijack\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01 R3 - URLSearchHook: (no name) - {3ADB627F-8EB4-8C4F-C52F-8BCD5F63D7CF} - C:\WINDOWS\System32\rmx.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3ADB627F-8EB4-8C4F-C52F-8BCD5F63D7CF} - C:\WINDOWS\System32\rmx.dll O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - F:\Program Files\WS_FTP Pro\wsbho2k0.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\System32\IETie.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\NavShExt.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - F:\Program Files\Save Flash\SaveFlash.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [LMSXXD] LMSXXD.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe" O4 - HKLM\..\Run: [ftpqueue] F:\Program Files\WS_FTP Pro\ftpqueue.exe -tray O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [{CC4978D5-0327-1033-0226-010507990001}] "C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe" te-110-12-0000213 O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Asme] "C:\WINDOWS\System32\WNSXS~1\services.exe" -vt yazr O4 - HKCU\..\Run: [mwrk] C:\PROGRA~1\COMMON~1\mwrk\mwrkm.exe O4 - HKCU\..\Run: [Vkczkp] C:\Program Files\??crosoft\?xplorer.exe O4 - Startup: Creative Element Power Tools Startup.lnk = F:\Program Files\Creative Element Power Tools\Startup.exe O4 - Startup: Eudora 6-GMspam.lnk = F:\Program Files\Qualcomm\Eudora\Eudora.exe O4 - Startup: Microsoft Find Fast.lnk = F:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Startup.lnk = F:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: A-Acrobat Assistant.lnk = F:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe O4 - Global Startup: A-eFax DllCmd 4.0.lnk = F:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe O4 - Global Startup: A-eFax Tray Menu 4.0.lnk = F:\Program Files\eFax Messenger 4.0\J2GTray.exe O4 - Global Startup: A-Gator eWallet.lnk = C:\Program Files\Gator.com\Gator\Gator.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &StealthBid - http://www.stealthbid.com/Toolbar/ContextMenu.aspx O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: StealthBid - {DA430631-621F-411c-A883-A4850D1928EC} - C:\WINDOWS\Downloaded Program Files\IQStealthBid.dll (HKCU) O9 - Extra 'Tools' menuitem: StealthBid - {DA430631-621F-411c-A883-A4850D1928EC} - C:\WINDOWS\Downloaded Program Files\IQStealthBid.dll (HKCU) O15 - Trusted Zone: *.netmagazines.com O16 - DPF: {271BEE78-FBBE-43D7-980B-58B5F53E34A7} (StealthBid Class) - http://www.stealthbid.com/Toolbar/IQStealthBid.cab O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/061...ie06101001.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000213 (file missing) O23 - Service: Ipswitch WS_FTP Queue (ftpqueue) - Ipswitch, Inc., 81 Hartwell Ave, Lexington MA 02421 - F:\Program Files\WS_FTP Pro\ftpsched.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Lexar SG20 (LxrSG20s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSG20s.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\Program Files\Norton\SystemWorks2003\Norton Utilities\NPROTECT.EXE O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\Norton\SYSTEM~2\SPEEDD~1\nopdb.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - F:\PROGRA~1\ALLUME~1\StuffIt\MXTask.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: SystemSuite Task Manager - V Communications, Inc. - F:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe |
| ||
| Re: I need help removing Update.exe Spyware/Adware Lavasoft.com ad-aware se personal |
| ||
| Re: I need help removing Update.exe Spyware/Adware The tool I use to diagnose HJT logs spits out all the bad entries it finds, so you can pick through what malware you wish to leave on your pc :). Please run the PurityScan uninstaller. == Can you please do the following. =============== When we're done cleaning off your system, I'd recommend that you install all the critical windows updates available from Microsoft, up to service pack 1. This will help to make your system more secure and prevent many 'problems' from reoccurring in the future. =============== Before we begin, let's move HiJackThis to it's own folder; like c:\HJT. When we're done 'cleaning' off your system, we're going to 'flush' the temporary folders which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later. Also move the "Backups" folder, for HiJackThis, if present. =============== Go to Add/Remove programs and uninstall the following, if present: CME II GMT, GAIN or GATOR The above could appear anywhere within the entry. Be careful not to remove any personal or system software. =============== Let's look for, and delete, any program segments (prefetches) that might be present, and are associated with the 'problems' we're trying to remove from your PC. To do this, let's: 1) Click "Start | Search", then search for each of these program's base name(s), in all files and folders: GMT.exe* mwrka.exe* 2) Then if any are found in the 'prefetch' folder, delete them. Look closely, since the 'base' name will have a bunch of random numbers and letters attached to it. =============== Next, Open a command prompt by: 1. Clicking "Start", then "Run...". 2. Enter "cmd" (without the quotes). 3. Enter "services.msc" (without the quotes). - Now, locate and 'stop' the following services, if present: COM+ Messages owner ... (C:\WINDOWS\System32\svchosts.exe) Look carefully, since the name of the service (above) can be anywhere in the entry; also be careful not to 'stop' any required system services. Once stopped, set this service to disabled. =============== Run HiJackThis then: 1. Click "Open the Misc Tools Section" 2. Click "Open Process manager" - Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following: C:\WINDOWS\System32\svchosts.exe C:\Program Files\Common Files\CMEII\CMESys.exe C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe C:\WINDOWS\System32\WNSXS~1\services.exe C:\PROGRA~1\COMMON~1\mwrk\mwrkm.exe C:\Program Files\??crosoft\?xplorer.exe C:\Program Files\Gator.com\Gator\Gator.exe C:\Program Files\Common Files\GMT\GMT.exe C:\PROGRA~1\COMMON~1\mwrk\mwrka.exe Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain. =============== Scan with HijackThis and then place a check next to all the following, if present: R3 - URLSearchHook: (no name) - {3ADB627F-8EB4-8C4F-C52F-8BCD5F63D7CF} - C:\WINDOWS\System32\rmx.dll O2 - BHO: (no name) - {3ADB627F-8EB4-8C4F-C52F-8BCD5F63D7CF} - C:\WINDOWS\System32\rmx.dll O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\System32\IETie.dll O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe" O4 - HKCU\..\Run: [Asme] "C:\WINDOWS\System32\WNSXS~1\services.exe" -vt yazr O4 - HKCU\..\Run: [mwrk] C:\PROGRA~1\COMMON~1\mwrk\mwrkm.exe O4 - HKCU\..\Run: [Vkczkp] C:\Program Files\??crosoft\?xplorer.exe O4 - Global Startup: A-Gator eWallet.lnk = C:\Program Files\Gator.com\Gator\Gator.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000213 (file missing) Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked". =============== Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders: folders... C:\Program Files\Common Files\CMEII C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001} C:\WINDOWS\System32\WNSXS~1 C:\PROGRA~1\COMMON~1\mwrk C:\Program Files\Gator.com C:\Program Files\Common Files\GMT files... C:\WINDOWS\System32\svchosts.exe C:\WINDOWS\System32\rmx.dll C:\WINDOWS\System32\IETie.dll - Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:
- Reboot. =============== After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now. |
| ||
| Re: I need help removing Update.exe Spyware/Adware Hello Crunchie Thanks for the quick reply, I really appreciate the help. It has taken a while and I have had to work through this a few times, and it looks like all has been fixed. ===================================================== CME II, GMT, GAIN / GATOR, GMT.exe, CMESys.exe, Gator.exe All appear to be related to Gator and I left them alone for now. Found empty folder: C:\WINDOWS\system32\WinSxS = C:\WINDOWS\System32\WNSXS~1 Folder and contents previously removed: C:\Program Files\Common Files\mwrk = C:\PROGRA~1\COMMON~1\mwrk C:\Program Files\Common Files\mwrk\mwrka.exe C:\Program Files\Common Files\mwrk\mwrkl.exe C:\Program Files\Common Files\mwrk\mwrkm.exe C:\Program Files\Common Files\mwrk\mwrkp.exe ... and other files ===================================================== Ran PurityScan uninstaller (again) =============== Found: C:\WINDOWS\Prefetch\GMT.EXE-00C623D4.pf C:\WINDOWS\Prefetch\MWRKA.EXE-38DEA512.pf C:\WINDOWS\Prefetch\MWRKL.EXE-2D78DA05.pf C:\WINDOWS\Prefetch\UPDATE.EXE-276CF44C.pf Deleted: C:\WINDOWS\Prefetch\MWRKA.EXE-38DEA512.pf =============== Ran: services.msc Found entry with Display name=[COM+ Messages] Service command="C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000213 Service was already Stopped. Service Startup type was set=Automatic Set service Startup type=Disabled =============== Ran HiJackThis-process manager: I found this process, highlighted it and clicked [Kill process]: C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe The process: C:\...\Update.exe closed successfully. =============== Not Found: C:\WINDOWS\System32\WNSXS~1\services.exe [folder was empty] C:\PROGRA~1\COMMON~1\mwrk\mwrkm.exe [folder/contents previously removed] C:\PROGRA~1\COMMON~1\mwrk\mwrka.exe [folder/contents previously removed] C:\Program Files\??crosoft\?xplorer.exe [folder/file not present] Found but left running: C:\Program Files\Common Files\CMEII\CMESys.exe C:\Program Files\Gator.com\Gator\Gator.exe C:\Program Files\Common Files\GMT\GMT.exe =============== Ran HijackThis-Scan: Found and checked only these four items: O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\System32\IETie.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000213 (file missing) Clicked to Fix these =============== Also removed entry: HKCU\..\Run: "C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe" =============== Deleted folder and contents: C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001} Deleted empty folder: C:\Program Files\Common Files\{3C4978D5-0327-1033-0226-010507990001} =============== Removed empty folder: C:\WINDOWS\System32\WNSXS~1 = C:\WINDOWS\system32\WinSxS Folder and contents previously renoved: C:\PROGRA~1\COMMON~1\mwrk =============== Removed files: C:\WINDOWS\System32\svchosts.exe C:\WINDOWS\System32\IETie.dll ===================================================== Rebooted and repeated some steps to remove some items that re-appeared. Then rebooted again. So far, all reboots are normal, not safe-mode. ===================================================== After 2nd and further Reboots: =============== Found these files --- should they be deleted ?: C:\WINDOWS\Prefetch\MWRKL.EXE-2D78DA05.pf 58.5 KB (59,938 bytes) C:\WINDOWS\Prefetch\OIUNINSTALLER.EXE-11C837B6.pf 13.5 KB (13,868 bytes) C:\WINDOWS\Prefetch\OIUNINSTALLER[1].EXE-11C837B6.pf 13.4 KB (13,748 bytes) C:\WINDOWS\Prefetch\UPDATE.EXE-276CF44C.pf 8.86 KB (9,078 bytes) =============== These folders/files are no longer present:-) C:\Program Files\Common Files\{3C4978D5-0327-1033-0226-010507990001} C:\Program Files\Common Files\{CC4978D5-0327-1033-0226-010507990001}\Update.exe C:\WINDOWS\System32\IETie.dll =============== This file is still present: C:\WINDOWS\Web\RELATED.HTM File RELATED.HTM contains referance to Msn.com only: http://related.msn.com/related.asp?url= =============== HijackThis no longer shows O23 - Service: COM+ Messages For HKLM\SYSTEM\ControlSet001\Services\COM+ Messages These key/values still exist in registry in three places: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\COM+ Messages HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\COM+ Messages HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COM+ Messages DisplayName=COM+ Messages ImagePath="C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000213 File: C:\WINDOWS\System32\svchosts.exe is no longer present. When I run services.msc, the entry for 'COM+ Messages' is still present. ===================================================== I still have a folder/files: C:\Program Files\Cowabanga C:\Program Files\Cowabanga\License.txt C:\Program Files\Cowabanga\uninstaller.exe License.txt refers to http://www.outerinfo.com/OiUninstaller.exe This is the same file/location given at http://www.purityscan.com/uninstall.html I will manually remove the folder and contents. ===================================================== What does the presence of mwrka.exe (and mwrk[almp].exe) indicate ? ===================================================== Do you know What this is --- I always find files in trash from here: C:\Program Files\Common Files\onudfbuu\mpaqrmcs C:\Program Files\Common Files\onudfbuu\oufqaqmosn ===================================================== Here is my latest HJT log ... thanks again ... Logfile of HijackThis v1.99.1 Scan saved at 4:43:17 AM, on 1/12/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE F:\Program Files\WS_FTP Pro\ftpsched.exe F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\navapsvc.exe F:\Program Files\Norton\SystemWorks2003\Norton Utilities\NPROTECT.EXE F:\PROGRA~1\Norton\SYSTEM~2\SPEEDD~1\nopdb.exe F:\PROGRA~1\ALLUME~1\StuffIt\MXTask.exe F:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe F:\PROGRA~1\VCOM\SYSTEM~1\mxtask.exe F:\PROGRA~1\ALLUME~1\StuffIt\mxtask.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\WINDOWS\System32\LMSXXD.exe C:\WINDOWS\Mixer.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe F:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe C:\Program Files\Gator.com\Gator\Gator.exe F:\Program Files\Creative Element Power Tools\Startup.exe F:\Program Files\Qualcomm\Eudora\Eudora.exe F:\Program Files\Microsoft Office\Office\FINDFAST.EXE F:\Program Files\Microsoft Office\Office\OSA.EXE C:\Program Files\Common Files\GMT\GMT.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\HijackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - F:\Program Files\WS_FTP Pro\wsbho2k0.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\NavShExt.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - F:\Program Files\Save Flash\SaveFlash.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [LMSXXD] LMSXXD.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe" O4 - HKLM\..\Run: [ftpqueue] F:\Program Files\WS_FTP Pro\ftpqueue.exe -tray O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: Creative Element Power Tools Startup.lnk = F:\Program Files\Creative Element Power Tools\Startup.exe O4 - Startup: Eudora 6-GMspam.lnk = F:\Program Files\Qualcomm\Eudora\Eudora.exe O4 - Startup: Microsoft Find Fast.lnk = F:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Startup.lnk = F:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Global Startup: A-Acrobat Assistant.lnk = F:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe O4 - Global Startup: A-Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: A-Gator eWallet.lnk = C:\Program Files\Gator.com\Gator\Gator.exe O8 - Extra context menu item: &StealthBid - http://www.stealthbid.com/Toolbar/ContextMenu.aspx O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: StealthBid - {DA430631-621F-411c-A883-A4850D1928EC} - C:\WINDOWS\Downloaded Program Files\IQStealthBid.dll (HKCU) O9 - Extra 'Tools' menuitem: StealthBid - {DA430631-621F-411c-A883-A4850D1928EC} - C:\WINDOWS\Downloaded Program Files\IQStealthBid.dll (HKCU) O15 - Trusted Zone: *.netmagazines.com O16 - DPF: {271BEE78-FBBE-43D7-980B-58B5F53E34A7} (StealthBid Class) - http://www.stealthbid.com/Toolbar/IQStealthBid.cab O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/061...ie06101001.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Ipswitch WS_FTP Queue (ftpqueue) - Ipswitch, Inc., 81 Hartwell Ave, Lexington MA 02421 - F:\Program Files\WS_FTP Pro\ftpsched.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Lexar SG20 (LxrSG20s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSG20s.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton\SystemWorks2003\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\Program Files\Norton\SystemWorks2003\Norton Utilities\NPROTECT.EXE O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\Norton\SYSTEM~2\SPEEDD~1\nopdb.exe O23 - Service: StuffIt Task Manager - Allume Systems, Inc. - F:\PROGRA~1\ALLUME~1\StuffIt\MXTask.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: SystemSuite Task Manager - V Communications, Inc. - F:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe |
| |||||||
| Re: I need help removing Update.exe Spyware/Adware 1 Attachment(s) Quote:
Quote:
Quote:
Quote:
Quote:
Reboot when done and check if the entries are gone. Quote:
Quote:
Apart from the obvious garbage you elected to keep, your HJT log looks ok :). Personally, I would install Roboform and use that. It can import your Gator settings and doesn't include the rubbish :D. |
| |||||||||
| Re: I need help removing Update.exe Spyware/Adware Quote:
Quote:
Quote:
At this point, there is a single related entry in the registry: [HKEY_LOCAL_MACHINE\SOFTWARE\Cowabanga] (default)="C:\Program Files\Cowabanga\Cowabanga.exe" The file Cowabanga.exe is not present so, unless you have some concerns, I feel it is safe to remove the related files, folders, and registry entry. Quote:
Quote:
Now, I will definately look into giving Roboform a try. Thanks again for all your help. |
| ||
| Re: I need help removing Update.exe Spyware/Adware 1 Attachment(s) Download the attached zip file and unzip fixme.reg. Close all browser windows. Double click the file to run it and when asked if you want to merge with your registry, answer yes. Info regarding Gator and Roboform http://www.cexx.org/gator.htm |
| All times are GMT -4. The time now is 5:19 am. |
Forum system based on vBulletin Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
©2003 - 2009 DaniWeb® LLC