Member Avatar for goodtaste

Hi! I'm trying my best not to have to post a HihackThis log and give you guys some added work, but I have a nasty I can't find. Norton Antivirus finds it every time and tells me about it but it won't remove it. I went to their site and got some more info and printed it out. I find out my nasty is hidden in C:\Windows\TemporaryInternetFiles\Content.IE5\OVIN2E3D\bridge-C18[1].cab and it is called WinAdToolsX.dll and it is fromSyncroAd.
Well, I tried to follow the steps given and put the computer on Safe Mode and looked for it but couldn't find it! I even ran a virus scan on safe mode in the hopes that Norton would delete it, but it didn't, it gave me the same result as before. Can anyone tell me where OVIN2E3D is?
Thank you very much! I need to delete this critter soon it is causing me lots of problems.

  • 4 Contributors
  • 8 Replies
  • 291 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by goodtaste

Dani AI

Generated

A short, practical add-on to the thread: the symptoms described by — an AV that reports an object inside Internet Explorer’s cache but can’t remove it, plus IE memory leaks/freezes — usually mean the item is living inside the browser cache database and is either locked by the running system or preserved by a restore/backup mechanism. ’s cache/temporary-file cleanup and ’s System Restore point note are on the right track, and ’s reminder to run tools from a permanent folder is important for accurate scans.

Why scanners sometimes can’t delete it: Internet Explorer stores cached items in randomized subfolders and keeps an index (index.dat) and open handles; Explorer’s normal view is a shell abstraction, so files can be “in” the cache but invisible or locked to other processes. System Restore (or similar backup snapshots) can also reintroduce a file after deletion, which explains transient detections even after apparent cleanup.

Recommended, reliable approach (ordered): first, ensure any automatic restore/snapshot feature is disabled so deletions aren’t restored; next, use an offline environment (boot from a recovery/live CD or a WinPE/BartPE USB) so Windows does not keep handles on the cache — then delete the specific cache subfolder or offending files directly from the mounted Windows drive. If offline deletion isn’t possible, use a handle/unlocker tool (or Process Explorer/Handle from Sysinternals) to find and close the locking handle, then remove the file. If the object is tied to an installed program, remove it with the normal uninstaller or a cleanup utility.

Aftercare and cautions: after removal, reboot into Windows, empty IE’s cache from Internet Options, run up-to-date full scans with both AV and anti‑spyware engines, and examine autostart entries with Autoruns/Process Explorer if available. Back up the registry and important files before manual edits, re-enable System Restore only after confirming the system is clean, and consider a fresh user profile or OS reinstall if instability continues.

Recommended Answers

All 8 Replies

Member Avatar for mikeandike22

you should just go ahead and post a hijackthis log it is not that much extra work and people will be able to see your problem

[img][/img]

Member Avatar for crunchie

Go to add\remove programs and uninstall Windows SyncroAd.

Clear out your Temporary internet files and other temp files.
Go to Start > Settings > Control Panel >Internet Options.
Under the General tab click the Delete temporary internet files,
delete all Offline content as well. Clear out Cookies.

Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

This one too if Win2K or XP.
C:\Documents and Settings\username\Local Settings\Temp\

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Empty the Recycle Bin.

Member Avatar for goodtaste

Thank you very much! I will first follow the steps suggested by Crunchie and if I still have the problem, then I'll post a HijackThis log.
Thanks again.

Member Avatar for goodtaste

Hi guys! Did all I could but I'm still having problems.
Here's my HijackThis log, hope you can "see" what I can't find:
Thanks as always!

Logfile of HijackThis v1.99.0
Scan saved at 12:47:03 PM, on 12/22/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\HPZTSB05.EXE
C:\PROGRAM FILES\TROJANHUNTER 4.0\THGUARD.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER PROFESSIONAL\POPUPSTOPPERPROFESSIONAL.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb05.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.0\THGUARD.EXE"
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER PROFESSIONAL\POPUPSTOPPERPROFESSIONAL.EXE"
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

Member Avatar for DMR

There's nothing suspicious in your log, but that doesn't mean you're not still infected.

Disable ME's System Restore function, reboot into safe mode, and try deleting the contents of the Temp folders again:

1. How to disable System Restore.

2. Reboot into safe mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- Delete the entire contents of all Temp and Temporary Internet Files folders.

Note - if you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed. Windows will allow you to delete the versions of those files which exist in sub-folders within the main Temp/Temorary folders, but might not let you delete the versions of those files that exist in the main Temp folders themselves; this is normal and OK.

- Empty your Recycle Bin.

- Reboot normally.

Member Avatar for mikeandike22

you have to run hijackthis out of its own directory on your hard drive it does not work effectively if you are running it out of a temporary directory.

Member Avatar for DMR

you have to run hijackthis out of its own directory...

Yikes- Thanks for the catch!

goodtaste:

Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders (as we've already instructed). If HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else! :eek: :eek:


Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.

Member Avatar for goodtaste

Thank you guys! I will follow those instructions I had followed Cruchie's and things got better, but I seem to have some leftover problem because my machine runs our of memory more than it ever has before and often freezed and yesterday I had to do a hard reboot. And it is all related to Internet Explorer, so it has something to do with a trojan because it happened to me the first time I had one. I don't know where this one is or perhaps pieces of it, but I'll try what I was adviced to do.)
Thanks again!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.