Member Avatar for maginsky

Hi folks, I have about 8hrs invested looking at other posts on this AB attempting to get rid of it and no luck. I'm running w98. Here is the HJT log file. Please assist on how to get rid of this darn thing. Thanks very much.

Logfile of HijackThis v1.99.0
Scan saved at 8:50:26 PM, on 12/21/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\CSMSS32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
N2 - Netscape 6: user_pref("browser.startup.homepage", ""); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\38bflpjx.slt\)
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://D%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%206%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\38bflpjx.slt\)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_19_0.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [spoolsvr32] c:\windows\system\csmss32.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] c:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0322.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0322.DLL
O9 - Extra button: Dell Home - {9F5D15C0-C92F-11D3-AFE0-0050DAC36557} - http://www.dell.com/ (file missing) (HKCU)
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *. (HKLM)
O15 - Trusted IP range:
O15 - Trusted IP range: (HKLM)
O16 - DPF: Serome Web2Phone -
O16 - DPF: Dialpad Java Applet -
O16 - DPF: Dialpad US Java Applet -
O16 - DPF: ppctlcab -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) -
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\PROGRAM FILES\HP\HPCORETECH\COMP\HPUIPROT.DLL
O19 - User stylesheet: (file missing)


Please assist on the next step, Thanks very much.
Maginsky

  • 3 Contributors
  • 4 Replies
  • 135 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by HackR

Dani AI

Generated

The HJT output in this thread shows a classic persistence/homepage symptom and a process that is masquerading as a system component. already ran an HJT scan; suggested enumerating Run/RunServices and running processes (good diagnostic move), and reports a removal by an AV vendor. Those are the right directions, but a systematic containment + removal plan is safer than relying on one tool.

Immediate steps

  • Disconnect the PC from the network to stop further callbacks.
  • Backup personal data to external media, but do not execute those files on the infected machine. Scan the backups on a known-clean system before restoring.
  • Try to run tools from Safe Mode. If the malware prevents that, use a bootable AV/rescue ISO (booting the machine from that media lets modern scanners work outside Windows).

Removal workflow (recommended order)

  • Use an up-to-date offline/rescue scan first (it bypasses running malware). If that removes the main component, follow with on-disk and registry scans.
  • Run a second-opinion scanner(s) from the rescue environment and from within Safe Mode. Do not rely on a single product.
  • Manual cleanup: export the registry keys you will change first. With HijackThis (or Autoruns/StartDreck), disable/remove unknown Run/RunServices entries, then confirm the corresponding executable path with a process viewer before deleting the file. If a file is locked, rename or delete it from the rescue environment or by mounting the drive on another clean machine.
  • Reboot, re-scan until clean. Check browser homepage, Hosts file, and winsock settings.

Cautions and last resort

  • Do not delete files unless you are sure they are malicious; many trojans use names similar to legitimate system files. Always verify full path and file properties.
  • If reinfection occurs or critical system components were replaced, the safest route is a full wipe and reinstall. Windows 98 is unsupported and inherently risky; consider migrating to a supported OS.
    If more help is needed, post a fresh StartDreck or HijackThis log and list which scanners and rescue media were used.

Recommended Answers

All 4 Replies

Member Avatar for crunchie

Download: "StartDreck", from here:

Unzip to its own folder and start the program,

Press 'Config'
Press 'Unmark All'

Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'

Press 'Save' and select the location to save the log file
(default is the same folder as the application)

Post the log in this thread.

Member Avatar for HackR

The file that is causing the problem is
C:\WINDOWS\SYSTEM\CSMSS32.EXE
I have had the same problem and found a fix which i posted to the following company.
They have updated their definitions over christmas and it now removes this new variant of about:blank which is to do with the Agent-AU trojan
Download adware away from here, once its installed, open it and click remove hijackers, on the left hand side

Member Avatar for crunchie

Actually C:\WINDOWS\SYSTEM\CSMSS32.EXE is the Troj/Agent-AU. A Trojan designed to disable firewall applications.

From SOPHOS

Troj/Agent-AU will attempt to disable the following applications:

Agnitum Outpost Firewall
Kaspersky Anti-Hacker
Kerio Personal Firewall 4
McAfee Personal Firewall
Norton Internet Security Professional
Tiny Firewall Pro
Zone Labs ZoneAlarm

http://www.sophos.com/virusinfo/analyses/trojagentau.html

Please do not give misleading information in order to promote a certain product.

Member Avatar for HackR

I am not in any way attempting to promote that product. Appologies if it seems that way.
I have emailed several other trojan removal companies including Mischel Internet Security which makes Trojan Hunter which i recommend as well, only adware away got back to me and fixed the problem for me.
It fixed my problem so i am recommending it.
I did not read the properly, i thought that the agent-au added this file, not that it was the trojan itself.
I have zonelabs and the csmss32 didnt kill it.

Appologies if my post was misleading, i only said how i fixed mine.
In future i wont bother helping

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.