944,029 Members | Top Members by Rank

Hardware and Software > Microsoft Windows > Viruses, Spyware and other Nasties > hijacked browser and spyware spybot won't delete
Ad:
Permalink
Sep 15th, 2005
0

hijacked browser and spyware spybot won't delete

Expand Post »
HELP - I have a web based interview at 1:00 and my machine is wacked. See HJT log below

Logfile of HijackThis v1.99.1
Scan saved at 9:39:33 AM, on 9/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\SurfAccuracy\SAcc.exe
C:\WINDOWS\etb\pokapoka67.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\System32\drwtsn32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.directsearchzone.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rr.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [System service67] C:\WINDOWS\etb\pokapoka67.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [stratas] lockx.exe
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\adsgone.exe
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/game...ts/y/st2_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommo...ad/tgctlcm.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120658789733
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c2.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\WINDOWS\System32\qlink32.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: AOL Instant Messenger (AOL Instant Messenger) - Unknown owner - C:\WINDOWS\USBSubsystem (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\ewido\security suite\ewidoctrl.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
Similar Threads
Reputation Points: 10
Solved Threads: 0
Light Poster
zgahi47 is offline Offline
31 posts
since Aug 2005
Permalink
Sep 15th, 2005
0

Re: hijacked browser and spyware spybot won't delete

Use this guide to run through a very thorough series of programs that will clean just about anything out of your system and help secure it from future threats.

If you don't have time to fix it, run a different browser: Firefox (popular IE replacement), Avant (based on IE services), and K-Meleon (lightweight browser).

Looking at your log, there are certain things that simply must go. Restart into Safe Mode and remove the following:
C:\WINDOWS\etb\pokapoka67.exe
O4 - HKLM\..\Run: [System service67] C:\WINDOWS\etb\pokapoka67.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [stratas] lockx.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
After removing those entries and before rebooting out of Safe Mode, find the "C:\WINDOWS\etb\pokapoka67.exe" and "lockx.exe" (search for it) files, delete them pemanently (hold shift down while deleting to delete permanently), and reboot your machine.
Reputation Points: 38
Solved Threads: 25
Posting Shark
chrisbliss18 is offline Offline
902 posts
since Aug 2005
Permalink
Sep 15th, 2005
0

Re: hijacked browser and spyware spybot won't delete

what's the best way to remove these entries? do i use HJT and fix them?
Reputation Points: 10
Solved Threads: 0
Light Poster
zgahi47 is offline Offline
31 posts
since Aug 2005
Permalink
Sep 15th, 2005
0

Re: hijacked browser and spyware spybot won't delete

Run HijackThis! from Safe Mode, select "Do a system scan only", let the scan finish, put a check next to each item that I indicated, and select "Fix checked".
Reputation Points: 38
Solved Threads: 25
Posting Shark
chrisbliss18 is offline Offline
902 posts
since Aug 2005
Permalink
Sep 15th, 2005
0

Re: hijacked browser and spyware spybot won't delete

I'm scared to reboot because I've been cleaning with adaware and manually deleting files in the registry that spybot won't clean and I'm afraid if I reboot everything will reappear and I wont't be able to complete my interview. I scanned with trendmicro and lost the results after an hour of scanning so I don't know that it found anything or not. Does it normally take that long to scan? Norton quarantined hacktool.rootkit and trojan elitebar. Thank you for your help.
Reputation Points: 10
Solved Threads: 0
Light Poster
zgahi47 is offline Offline
31 posts
since Aug 2005
Permalink
Sep 15th, 2005
0

Re: hijacked browser and spyware spybot won't delete

If you are running these tools and making these changes from Safe Mode, the likelyhood of the files or registry settings coming back after a reboot is very slim.

As for how long it takes Trend Micro to scan your system, that depends on how many files you have. It can very well take that long if you have a lot of stuff on your machine. I would think that your main problem is Spyware, so you might want to skip ahead to Step 2 for now and go back to Step 1 after your interview.

As I said before, if you are pressed for time, just get a different browser to use for the interview. After the interview is over, you can go back to cleaning up your machine.
Reputation Points: 38
Solved Threads: 25
Posting Shark
chrisbliss18 is offline Offline
902 posts
since Aug 2005
Permalink
Sep 15th, 2005
0

Re: hijacked browser and spyware spybot won't delete

I'm not doing any of it in safe mode as I thought I couldn't. I do have my system restore off but I guess that won't matter??? I have to be on IE for the interview or I'd run Mozilla. I think my browser is fine now and I downloaded and ran Microsoft's antispyware and it cleaned a lot of stuff as did adaware. I'm ok for now until after the interview then I'll go through your step by step instructions. Thanks so much for that info.
Reputation Points: 10
Solved Threads: 0
Light Poster
zgahi47 is offline Offline
31 posts
since Aug 2005

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: Please help with " rdriv.sys" virus
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Help Needed.....Hacktool-Rootkit and msdirectx.sys





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC