944,204 Members | Top Members by Rank

Ad:
Jun 12th, 2006
0

spyware problems

Expand Post »
i am having problems with spyware. it keeps popping up a small box that says you have a virus on your computer and to click here. then a web browser page comes up with the same thing. i close them out and they keep coming up again after about 3 to 5 minutes. When i am on the internet explorer, and i hit home which is msn page for me, it takes me to a page called aboutblank.com. i sent a thread last week with this problem and you told me to run the highjackthis program and send it to you. I will attatch it to this thread and hopefully you can look at it and give me some direction to fix this problem. thanks , jack burnside

Logfile of HijackThis v1.99.1
Scan saved at 2:34:04 PM, on 6/12/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\users32.exe
c:\program files\mcafee.com\agent\mcupdate.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {00000000-59D4-4008-9058-080011001200} - (no file)
O2 - BHO: (no name) - {00000000-C1EC-0345-6EC2-4D0300000000} - (no file)
O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file)
O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} - (no file)
O2 - BHO: adobepnl.ADOBE_PANEL - {5E8FA924-DEF0-4E71-8A82-A11CA0C1413B} - C:\WINDOWS\System32\adobepnl.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: (no name) - {7b55bb05-0b4d-44fd-81a6-b136188f5deb} - (no file)
O2 - BHO: (no name) - {8333c319-0669-4893-a418-f56d9249fca6} - (no file)
O2 - BHO: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file)
O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file)
O2 - BHO: (no name) - {ffd2825e-0785-40c5-9a41-518f53a8261f} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\System32\runsrv32.exe
O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\System32\susp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1139167918218
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents...r/imloader.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
teddyburnside is offline Offline
4 posts
since Jun 2006
Jun 12th, 2006
0
Re: spyware problems
First of all move HJT to its own folder such as C:/HJT
Then run HJT and check the following
C:\WINDOWS\System32\users32.exe
C:\WINDOWS\System32\adobepnl.dll
O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\System32\runsrv32.exe
O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\System32\susp.exe
R3 - Default URLSearchHook is missing

Also check the items that say BHO (no name)....(no file)

Close all other windows except HJT and click the fix checked button

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFixfolder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Ok now we need to delete some files. Plz delete the following

C:\WINDOWS\System32\susp.exe
C:\WINDOWS\System32\runsrv32.exe
C:\WINDOWS\System32\users32.exe

If you cant manually do this download pocket killbox from here
once you have it up and running select the box where it says Delete on reboot then click where it says all files. Now click on the folder icon and select those files. Click the kill button and the program should automatically restart your computer.
Reboot and post a new log. Also tell me how your computer is doing.


srry forgot to put the link to pocket killbox so here it is.
Last edited by tayspen; Jun 12th, 2006 at 11:29 pm. Reason: Thread merge...
Team Colleague
Reputation Points: 55
Solved Threads: 39
A.K.A. The Laughing Man
kylethedarkn is offline Offline
600 posts
since May 2006
Jun 13th, 2006
0

Re: spyware problems

i opened the hjt folder and checked the files that were there, but the two windows\system32\users32.exe and windows\system32\adobepnl.dll files were not in the list with boxes to check. i ran the scan anyway and clicked fix checked ones and then i downloaded the smithfraudfix, and saved it to my desktop and opened it,and opened the smithraudfix.cmd and it opened up a black box with the title above it that says windows\system32\cmd.exe, and there is no number 1 or 2 options, just a black screen and i even tried to type in a 1 or 2 and it did nothing. what do i do next?
Reputation Points: 10
Solved Threads: 0
Newbie Poster
teddyburnside is offline Offline
4 posts
since Jun 2006
Jun 13th, 2006
0

Re: spyware problems

Are you sure you extracted the program before you ran
Also what problems do you have on your computer since you deleted those processes
Team Colleague
Reputation Points: 55
Solved Threads: 39
A.K.A. The Laughing Man
kylethedarkn is offline Offline
600 posts
since May 2006
Jun 13th, 2006
0

Re: spyware problems

i extracted the smitfraudfix file again and put it on the desktop in a folder called smitfraudfix. i opened the folder and double clicked on the smitfraudfix.cmd file and it opened up the black box with windows\system32\cmd.exe again, with no text in the box. i tried topping 1 and 2 and nothing goes into the box. i am still having the same problems since i deleted the files in highjack this. when i ran the highjack this program it still doesn't find the windows\system32\users32.exe, and windows\system32\adobepnl.dll files, so i can't run a fix checked on these two. i am still having the same problems with the popup that keeps coming up and saying i have a virus and when i hit cancel on that one a web page comes that says something about buying some antivirus software. the page says aboutblank.com
Reputation Points: 10
Solved Threads: 0
Newbie Poster
teddyburnside is offline Offline
4 posts
since Jun 2006
Jun 16th, 2006
0

Re: spyware problems

Check the system32 folder and make sure the processes that I told you to delete are gone.
Team Colleague
Reputation Points: 55
Solved Threads: 39
A.K.A. The Laughing Man
kylethedarkn is offline Offline
600 posts
since May 2006

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: Pop up pain in the a** rant
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Dell dimension 3000 my way search assistant





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC