User Name Password Register
DaniWeb IT Discussion Community
Home
Forums
Tutorials
Blogs
Link Directory
All
•
•
•
•
What is DaniWeb IT Discussion Community?
You're currently browsing the Viruses, Spyware and other Nasties section within the Tech Talk category of DaniWeb, a massive community of 426,030 software developers, web developers, Internet marketers, and tech gurus who are all enthusiastic about making contacts, networking, and learning from each other. In fact, there are 1,733 IT professionals currently interacting right now! Registration is free, only takes a minute and lets you enjoy all of the interactive features of the site.
Join our community!
Please support our Viruses, Spyware and other Nasties advertiser: Programming Forums
Views: 1188 | Replies: 10
Reply
Page 1 of 2 1 2 >
•
•
Join Date: Jul 2005
Posts: 6
Reputation: MCOBigBen is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
MCOBigBen MCOBigBen is offline Offline
Newbie Poster

ABI Network trouble

  #1  
Jul 7th, 2005
I've picked up a browser hijack and an extra toolbar that won't uninstall. Every time I reboot, Ad-Aware catches 30 or so baddies. I'm running a MacAfee firewall and virus protection, and use Ad-Aware and SpyBot on a fairly regular basis.

Here's a log from after a reboot and an Ad-Aware scan. Any help would be greatly appreciated.

~Ben

Logfile of HijackThis v1.99.1
Scan saved at 10:17:36 PM, on 7/6/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\ujwmmxa.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\svcnt.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\svcproc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdocsv.dll/blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocsv.dll/asst.htm
R3 - URLSearchHook: (no name) - {5590E23D-D864-CA4C-3697-FDC87F0F87A6} - bingo9.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SysEntry] sbin.exe
O4 - HKLM\..\Run: [uio] progmen.exe
O4 - HKLM\..\Run: [tupeyh] c:\windows\system32\ujwmmxa.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [NsCplTray] MSTCPDLL.exe
O4 - HKCU\..\Run: [prcmon] nmdllw.exe
O4 - HKCU\..\Run: [corrida] ftbar.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {11010101-1001-1111-1000-110112345678} - mkmSItSTORE:Mhtml:FiLE://C:\html.mHT!http://205.177.122.27/docs/xxx/html.chm::/html.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
AddThis Social Bookmark Button
Reply With Quote  
•
•
Join Date: Dec 2003
Location: Marin County, CA
Posts: 6,439
Reputation: DMR will become famous soon enough DMR will become famous soon enough 
Rep Power: 18
Solved Threads: 339
Colleague
DMR's Avatar
DMR DMR is offline Offline
Wombat At Large

Re: ABI Network trouble

  #2  
Jul 7th, 2005
Please perform the following standard Aurora (ABI) removal proceedure; it will clean up a lot of the other "nasties" indicated in your log as well:


You will need to disconnect from the Internet for most of the cleaning procedures, so you should print out the following instructions or save them into a text file using Notepad.


* Download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

* Download Nailfix from here:
http://www.noidea.us/easyfile/file....050515010747824
Unzip it to the desktop but please do NOT run it yet.


* Open the Services utility in your Administrative Tools control panel.

- In the list of services, locate the service named "System Startup Service" or "SvcProc" and double-click on it.

- In the General tab of the Properties window that opens, click the Stop button.

- Once the service is stopped, choose Disabled in the "Startup Type" drop-down menu and then click OK. Close the Services utility after that.


* Next, reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml


* Once in Safe Mode, double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly (this is normal).


* Then run Ewido, and run a full scan. Save the logfile from the scan.


* Next run HijackThis, click Scan, and put a check in the box to the left of:

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Close all open windows except for HijackThis and click Fix Checked.


* Once HJT finishes the fix, click on the "Config" button in the lower right corner of HijackThis' main window.

- In the next window click on the "Misc Tools" button at the top then click the "Delete an NT service" button. Type the following in the box and click OK:

svcproc

- Close HijackThis


* Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders (but not the folders themselves):

Important: One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if any data that you care about is living in those Temp folders, you need to move it to a safe location now, or it will be erased along with everything else!

1. Cookies
2. Local Settings\Temp
3. Local Settings\History
4. Local Settings\Temporary Internet Files

- Delete the entire content of your C:\Windows\Temp folder.

- Delete the entire content of your C:\Windows\Prefetch folder.

Note- If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed. Windows will allow you to delete the versions of those files which exist in sub-folders within the main Temp/Temorary folders, but might not let you delete the versions of those files that exist in the main Temp folders themselves; this is normal and OK.

- Empty your Recycle Bin.

Restart your computer in normal mode and post a new HijackThis log, as well as the log from the Ewido scan.
"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing

Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.

However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
Reply With Quote  
•
•
Join Date: Jul 2005
Posts: 6
Reputation: MCOBigBen is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
MCOBigBen MCOBigBen is offline Offline
Newbie Poster

Re: ABI Network trouble

  #3  
Jul 7th, 2005
OK, I followed the instructions, but when I ran Hijackthis in safemode, I didn't see O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Using 'Delete an NT Service' to delete svcproc also failed.

When I rebooted, alarms went off in both McAfee Virusscan and in ewido.

I appreciate the help so far, any other suggestions?

Here are the logs:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 7:58:28 PM, 7/7/2005
+ Report-Checksum: 401846AB

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B5AB638F-D76C-415B-A8F2-F3CEAC502212} -> Spyware.AproposMedia : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{11010101-1001-1111-1000-110112345678} -> Dialer.Generic : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDH -> Spyware.DealHelper : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\Toolbar -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\Toolbar\PlugIns -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\Toolbar\PlugIns\COMMON -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\Toolbar\PlugIns\RADIO -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\Toolbar\Server -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\Toolbar\UrlSearchHooks -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\WareOut -> TrojanDownloader.Wareout : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\WareOut\FirstRun -> TrojanDownloader.Wareout : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\WareOut\Options -> TrojanDownloader.Wareout : Cleaned with backup
HKU\S-1-5-21-299502267-1682526488-1343024091-1003\Software\WareOut\Registration -> TrojanDownloader.Wareout : Cleaned with backup
C:\Documents and Settings\Ben Jones\Cookies\ben jones@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temp\LVR\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temp\UWV\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temp\wupdt.exe -> TrojanDownloader.Intexp.c : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temporary Internet Files\Content.IE5\1B77HPGA\html[1].exe -> TrojanDownloader.Delf.ks : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temporary Internet Files\Content.IE5\KPYRSL63\winupdate23618989[1].exe -> TrojanDropper.Small.ue : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temporary Internet Files\Content.IE5\S36JIXYD\Poller[1].exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Ben Jones\Local Settings\Temporary Internet Files\Content.IE5\WL6RKP2Z\update[1].exe -> TrojanDropper.Vidro.p : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Cookies\shelley jones@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temp\1.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temp\ptf_0024.exe -> Spyware.Pacer : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temporary Internet Files\Content.IE5\4R7F2GXL\downloaddll[1].htm -> Spyware.DealHelper : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temporary Internet Files\Content.IE5\NB1ZRP08\download[1].htm -> Trojan.Popmon.a : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temporary Internet Files\Content.IE5\NB1ZRP08\version[1].exe -> Spyware.DealHelper : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temporary Internet Files\Content.IE5\T4WJT58T\download[1].htm -> Trojan.Popmon.a : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temporary Internet Files\Content.IE5\T4WJT58T\trk_0024[1].exe -> Spyware.Pacer : Cleaned with backup
C:\Documents and Settings\Shelley Jones\Local Settings\Temporary Internet Files\Content.IE5\YPTM3MP4\thin_poker_installer[1].exe -> Adware.BetterInternet : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
C:\Program Files\FwBarTemp\searchbar.exe -> TrojanDownloader.VB.eu : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000001.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000004.exe -> TrojanDropper.Vidro.p : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000009.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000023.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000025.exe -> TrojanDropper.Vidro.p : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000031.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000043.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP1\A0000045.dll -> TrojanSpy.Agent.am : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000049.dll -> TrojanSpy.Agent.am : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000051.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000054.exe -> TrojanDropper.Vidro.p : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000059.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000072.dll -> TrojanSpy.Agent.am : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000073.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000074.exe -> Spyware.FindSpy : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000079.exe -> TrojanDropper.Vidro.p : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000082.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000083.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{860C3154-A37D-41CC-B9C2-1BFF78D49A3A}\RP2\A0000084.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\html.exe -> TrojanDownloader.Delf.ks : Cleaned with backup
C:\WINDOWS\system32\dist001.exe -> TrojanDownloader.VB.eu : Cleaned with backup
C:\WINDOWS\system32\drv2cltr.dll -> TrojanSpy.Agent.am : Cleaned with backup
C:\WINDOWS\system32\Gfmehu.exe -> Spyware.DealHelper : Cleaned with backup
C:\WINDOWS\system32\Kylwig.exe -> Trojan.Popmon.a : Cleaned with backup
C:\WINDOWS\system32\mspgxxn.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\Qlfjsf.exe -> Trojan.Popmon.a : Cleaned with backup
C:\WINDOWS\system32\svcnt.exe -> TrojanDownloader.Delf.ks : Cleaned with backup
C:\WINDOWS\yxawktcf.exe -> Spyware.BookedSpace : Cleaned with backup
D:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
D:\WINDOWS\system\UpdInstall.exe -> Spyware.Look2Me : Cleaned with backup
D:\Documents and Settings\me\Cookies\me@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
D:\Documents and Settings\Shelley\Local Settings\Temp\temp.frDBD5\toolbar.dll -> Spyware.WebSearch : Cleaned with backup
D:\Documents and Settings\Shelley\Cookies\shelley@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup


::Report End














________________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 8:18:59 PM, on 7/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\shared\mcinfo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Valve\Steam\Steam.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdocsv.dll/blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocsv.dll/asst.htm
R3 - URLSearchHook: (no name) - {5590E23D-D864-CA4C-3697-FDC87F0F87A6} - bingo9.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll (file missing)
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SysEntry] sbin.exe
O4 - HKLM\..\Run: [uio] progmen.exe
O4 - HKLM\..\Run: [hygnrrd] c:\windows\system32\wgqnopm.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [NsCplTray] MSTCPDLL.exe
O4 - HKCU\..\Run: [prcmon] nmdllw.exe
O4 - HKCU\..\Run: [corrida] ftbar.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
Last edited by MCOBigBen : Jul 7th, 2005 at 11:23 pm. Reason: forgot to say thanks :D
Reply With Quote  
•
•
Join Date: Jul 2005
Posts: 6
Reputation: MCOBigBen is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
MCOBigBen MCOBigBen is offline Offline
Newbie Poster

Re: ABI Network trouble

  #4  
Jul 8th, 2005
I didn't see any forum rules list, I assume it's OK to bump?

~Ben
Reply With Quote  
•
•
Join Date: Dec 2003
Location: Marin County, CA
Posts: 6,439
Reputation: DMR will become famous soon enough DMR will become famous soon enough 
Rep Power: 18
Solved Threads: 339
Colleague
DMR's Avatar
DMR DMR is offline Offline
Wombat At Large

Re: ABI Network trouble

  #5  
Jul 9th, 2005
It's not against the rules, but we don't really encourage it either. This is a pretty busy forum, and those of help out are only doing so as volunteers on our free time, so it isn't unusual that a thread may go unanswered for 24 hrs or more.

I'm going to sleep shortly, but I do have this thread flagged, and will get back to it tomorrow.
"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing

Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.

However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
Reply With Quote  
•
•
Join Date: Jul 2005
Posts: 6
Reputation: MCOBigBen is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
MCOBigBen MCOBigBen is offline Offline
Newbie Poster

Re: ABI Network trouble

  #6  
Jul 9th, 2005
Thanks, I appreciate it.
~Ben
Reply With Quote  
•
•
Join Date: Dec 2003
Location: Marin County, CA
Posts: 6,439
Reputation: DMR will become famous soon enough DMR will become famous soon enough 
Rep Power: 18
Solved Threads: 339
Colleague
DMR's Avatar
DMR DMR is offline Offline
Wombat At Large

Re: ABI Network trouble

  #7  
Jul 9th, 2005
You're welcome.

Post the new log when you can; I'll be around for most day.
"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing

Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.

However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
Reply With Quote  
•
•
Join Date: Jul 2005
Posts: 6
Reputation: MCOBigBen is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
MCOBigBen MCOBigBen is offline Offline
Newbie Poster

Re: ABI Network trouble

  #8  
Jul 9th, 2005
Certainly! This is after sweeping with AdAware, Spybot, and ewido. I'm getting warnings from ewido and McAfee Viruscan every time I open my browser (Firefox)

Logfile of HijackThis v1.99.1
Scan saved at 1:39:47 PM, on 7/9/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Valve\Steam\Steam.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocsv.dll/asst.htm
R3 - URLSearchHook: (no name) - {5590E23D-D864-CA4C-3697-FDC87F0F87A6} - bingo9.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll (file missing)
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SysEntry] sbin.exe
O4 - HKLM\..\Run: [uio] progmen.exe
O4 - HKLM\..\Run: [hygnrrd] c:\windows\system32\wgqnopm.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [NsCplTray] MSTCPDLL.exe
O4 - HKCU\..\Run: [prcmon] nmdllw.exe
O4 - HKCU\..\Run: [corrida] ftbar.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
Reply With Quote  
•
•
Join Date: Dec 2003
Location: Marin County, CA
Posts: 6,439
Reputation: DMR will become famous soon enough DMR will become famous soon enough 
Rep Power: 18
Solved Threads: 339
Colleague
DMR's Avatar
DMR DMR is offline Offline
Wombat At Large

Re: ABI Network trouble

  #9  
Jul 10th, 2005
McAfee is supposed to be able to deal with at least one of the infections you have. Have you run a full system scan with McAfee after making sure you've installed the most current virus definitions? Do that if you haven't already.

There will more cleanup to do after this, but to start with:

1. Look in your Add/Remove Programs control panel to se if the WareOut program is listed there. If it iss, uninstall it; the program is spyware disguised as a spyware remover. Go here for more information on WareOut and other "rogue" anti-spyware programs.


2. Run HJT again and have it fix:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocsv.dll/asst.htm
R3 - URLSearchHook: (no name) - {5590E23D-D864-CA4C-3697-FDC87F0F87A6} - bingo9.dll (file missing)
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll (file missing)
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ylyel.dll (file missing)
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SysEntry] sbin.exe
O4 - HKLM\..\Run: [uio] progmen.exe
O4 - HKLM\..\Run: [hygnrrd] c:\windows\system32\wgqnopm.exe r
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [NsCplTray] MSTCPDLL.exe
O4 - HKCU\..\Run: [prcmon] nmdllw.exe
O4 - HKCU\..\Run: [corrida] ftbar.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{42989C9C-B187-4175-A9E2-790A73F68EBB}: NameServer = 69.50.176.196,195.225.176.110


3. Reboot into safe mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- Locate and delete the following files; notes the names of any files which you cannot find or cannot delete:

shdocsv.dll
bingo9.dll
C:\WINDOWS\system32\svcnt.exe
SOUNDMAN.EXE
sbin.exe
progmen.exe
c:\windows\system32\wgqnopm.exe
MSTCPDLL.exe
nmdllw.exe
ftbar.exe

- delete the following folder entirely:

C:\Program Files\WareOut

- For every user account listed under C:\Documents and Settings, delete the entire contents of the following folders (but not the folders themselves):

(Important: One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if any data that you care about is living in those Temp folders, you need to move it to a safe location now, or it will be erased along with everything else!)

1. Cookies
2. Local Settings\Temp
3. Local Settings\History
4. Local Settings\Temporary Internet Files

- Delete the entire content of your C:\Windows\Temp folder.

- Delete the entire content of your C:\Windows\Prefetch folder.

Note- If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed. Windows will allow you to delete the versions of those files which exist in sub-folders within the main Temp/Temorary folders, but might not let you delete the versions of those files that exist in the main Temp folders themselves; this is normal and OK.

- Empty your Recycle Bin.


4. Reboot normally, run HJT again, and post a new log.
"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing

Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.

However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
Reply With Quote  
•
•
Join Date: Jul 2005
Posts: 6
Reputation: MCOBigBen is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
MCOBigBen MCOBigBen is offline Offline
Newbie Poster

Re: ABI Network trouble

  #10  
Jul 11th, 2005
Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 10:10:11 PM, on 7/10/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Valve\Steam\Steam.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocsv.dll/asst.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar_en_2.0.114-big.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/download...1/axofupld.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
Reply With Quote  
Reply
Page 1 of 2 1 2 >

•
•
•
•

Only community members can participate in forum threads. You must register or log in to contribute.

Register
•
•
•
•
•
•
•
•
DaniWeb Viruses, Spyware and other Nasties Marketplace
•
•
•
•
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

 

•
•
•
•
Thread Tools Display Modes
Linear Mode Linear Mode

•
•
•
•
adsl adsl1 adsl2 adsl2+ adware cable complete information connection core defender download engineering fedora installation internet kb kbps legal linux malware mbit mcafee microsoft mmorpg network new folder new viruses news nhatquanglan per persuade pirate reliability search second security social software spyware survey svchost testing throughput upload virus viruses vista windows xp workgroup 240000
Similar Threads
Other Threads in the Viruses, Spyware and other Nasties Forum

Advertising Opportunities on DaniWeb
Contact Us - Newsletter Archive - Sitemap - Privacy Statement
All times are GMT -4. The time now is 1:55 am.
Forum system based on vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
©2003 - 2008 DaniWeb® LLC