Member Avatar for dashow

Every time I open up a new internet page or if I go into My Computer, a Norton Antivirus warning pops up saying virus alert and it is unable to repair this file. I have run HJT and here is the logfile:

Logfile of HijackThis v1.99.1
Scan saved at 8:49:35 PM, on 9/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Internet Security\ISSVC.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\etb\pokapoka67.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\AOL\1126154877\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1126154877\ee\AOLServiceHost.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\TrojanHunter 4.2\InstTimeUpdater.exe
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [regcmdcons] c:\hp\bin\cloaker.exe c:\hp\bin\cmdcons.cmd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 4.2\THGuard.exe
O4 - HKLM\..\Run: [System service67] C:\WINDOWS\\etb\pokapoka67.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WMP54GSSVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe" "WMP54GSv1_1.exe (file missing)

I know that the pokapoka67 file is a trojan file but everytime I try to have HJT fix it, it doesnt work. The file remains on my computer, What should I do??? Desperate for help.

  • 3 Contributors
  • 7 Replies
  • 190 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by swatkat

Dani AI

Generated

Brief expert summary and next steps for the PokaPoka / EliteBar problem reported above. The behavior described in the thread — HJT “removing” the file but the infection returning after reboot — matches known EliteBar/PokaPoka variants that install a hidden component and use API hooks to hide files/processes and re-create persistence. See the vendor analysis for technical details. (f-secure.com)

Why scans and HJT often fail: these variants inject a DLL that intercepts file/registry enumeration so ordinary tools and on-disk removers can’t see or delete the running components. A rootkit-style scan is needed to find discrepancies between the normal Windows API view and the native/native-API view of files and registry keys. Renaming a scanner to certain benign names (documented for this family) can sometimes reveal hidden objects. (learn.microsoft.com)

Practical, ordered approach (do not rely on a single scan): download the specialist remover on a clean machine and run it from removable media (for example the EliteToolbar/PokaPoka remover), then perform an offline boot-time scan if the remover cannot fully clean the system. Use an offline/bootable scanner (Microsoft Defender Offline or a reputable rescue disk) so the malware cannot defend itself from inside Windows. After cleaning, use an autorun/startup auditor to remove the persistence points (Run keys, services, BHOs) rather than only deleting files. Run multiple updated scanners after each step until nothing returns. ETRemover · Microsoft Defender Offline · Autoruns (Sysinternals). (simplytech.it)

Cautions and last-resort plan: disconnect the machine from the network while cleaning, back up personal data (scan backups before restoring), avoid manual registry deletions unless comfortable with recovery, and expect that a persistent reappearance may require a full OS reinstall to guarantee removal. The initial steps suggested by and the tools suggested by are sensible first moves, but the EliteBar/PokaPoka family often needs the rootkit-aware tools and an offline scan described above to stop it from coming back. (f-secure.com)

Recommended Answers

All 7 Replies

Member Avatar for ShaneMcP

Are your anti-virus definitions up-to-date? Update them if they aren't a moderator will probably respond to this, but they are usually busy, so let me see if I can start you off correctly. There are a few things you can do in really any order.

1)Get Mozilla Firefox www.mozilla.org/firefox
2)Use Mozilla Firefox until your problem with internet explorer is solved
3)Go to microsofts website (in firefox) and get microsoft anti-spyware
4)Update MS Antispyware
5)Reboot your PC
6)Repeatedly press f8 upon startup and select boot into safe mode with networking support
7)Run Microsoft Anti-spyware
8)If you have to restart, restart into safe mode with networking support again
9)Open Internet explorer and go to
10)Run a virus scan, or a spyware and virus scan and wait until it completes
11)Select the option to remove the viruses and spyware
12)Update us on the status of your problem

Member Avatar for dashow

ok, I did what you told me to do and nothing really happened. Antispyware did detect something but that wasnt the Trojan. So I still need help on removing it.

Member Avatar for swatkat

Hi,
Download and place it on your desktop.
Doubleclick LQfix.exe and click install.
Leave the default settings. If you change them, the fix will fail.
Make sure 'Launch LQfix' is checked. After clicking finish in the install, the fix will start.
Follow the prompts on the screen.
Your system will reboot afterwards.
Please be patient after reboot, because there is a script running in the background.


After this, post a fresh HijackThis log.

Member Avatar for ShaneMcP

ok, I did what you told me to do and nothing really happened. Antispyware did detect something but that wasnt the Trojan. So I still need help on removing it.

Did you go to housecall's website and run their scan?

Member Avatar for dashow

yeah and just now I went back to HJT and did about 10 scans, selecting the pokapoka67 file everytime. After the 10th time the file disappeared and now there are no popups. So if something else happens Ill let you guys know but I think it will work now.

Member Avatar for dashow

ok that didnt work. When I used LQFix again, it doesnt recognize any of the trojans. When I run HJT, it delets the pokapoka67 file until I reboot my computer. So I havent been able to get anywhere yet. My HJT log is still the same too.

Member Avatar for swatkat

Hi,

Download WinPFind.ZIP and completely extract it to a folder. Then run WinPFind.exe and click "Start Scan". When the scan completes, click "Copy to Clipboard" button to copy the log it gives, and please post it here.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.