Member Avatar for Member #72909

Hello, all!!

I am new to this forum, but by reading through some of the threads, I can see that it is a great community, who offer timely helpful comments. I have been infected by a worm and I can't seem to get rid of it. Below is my most recent HiJackThis log.

Any help that anyone can provide would be greatly appreciated.

Thanks,
Matt

Logfile of HijackThis v1.99.1
Scan saved at 6:35:07 PM, on 4/21/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\nvctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eSnips\ClientGW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
C:\Program Files\eFax Messenger 4.0\J2GTray.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINNT\system32\mssearchnet.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Desktop\HiJackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R3 - URLSearchHook: (no name) - {013CE0E5-7B2E-60EE-7C82-5087EAF4BEBB} - C:\WINNT\system32\nnr.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Nothing - {edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e} - C:\WINNT\system32\hp60BB.tmp
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: eSnips - {ED1184DA-E57E-4480-99D0-A16809037F54} - C:\Program Files\eSnips\SnipBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eSnips] "C:\Program Files\eSnips\ClientGW.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O20 - Winlogon Notify: winprb32 - C:\WINNT\SYSTEM32\winprb32.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  • 3 Contributors
  • 6 Replies
  • 187 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by 'Stein

Dani AI

Generated

Good outcome: the Ewido/Spybot work removed the active payloads and the remaining items in the HijackThis output are orphaned Winlogon notification stubs (the DLLs were removed but registry entries were left behind). Winlogon notification packages are registered under the Winlogon key and Windows will try to load any DLLs listed there at logon, so orphaned entries should be removed safely only after a backup is made. (learn.microsoft.com)

Safe cleanup workflow (non‑destructive first): capture an Autoruns save, then disable the suspect Winlogon entries to test system stability; if nothing breaks, remove them permanently. For a manual approach open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify, right‑click the specific subkey (for example: winprb32), use File → Export to save a .reg backup, then delete the subkey and reboot to confirm. On Windows 2000 some registry tasks historically used Regedt32; always export the key before any delete. Autoruns lets one “disable first, delete later” which is safer for troubleshooting. (learn.microsoft.com)

Verify leftovers before deleting: if the DLL file still exists in System32, do not delete it blindly — check the file publisher via File Properties or use Sysinternals Sigcheck to inspect the digital signature and hashes (sigcheck -u -e c:\windows\system32 is useful). If signatures look bogus or the file is present and suspicious, run up‑to‑date scanners and a rootkit check (RootkitRevealer is a practical on‑system tool); if rootkit behavior is suspected, offline repair or a reformat+reinstall is the safe option. (learn.microsoft.com)

Practical notes and hygiene: keep the one‑time removal tools installed only as long as they are needed, retain Ewido or another on‑demand scanner for a follow‑up scan, change any exposed passwords used while the machine was infected, and fully patch the OS and browsers. Credit for the cleanup steps in the thread to and — the remaining action is the controlled removal of the orphaned Winlogon stub (backup first, disable then delete).

Recommended Answers

All 6 Replies

Member Avatar for 'Stein

Welcome to daniweb. Heh it IS in fact a great community to work at too. Now let's get down to business. I'll admit it, you're pretty infected, but we can fix everything that's in there.

Let's begin by downloading Ewido and SpySweeper (links for both are in my sig below). Update definitions for both, and run full scans with both, fixing everything they find, and saving both logs.

After doing that, restart your computer and fix the following through HJT:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R3 - URLSearchHook: (no name) - {013CE0E5-7B2E-60EE-7C82-5087EAF4BEBB} - C:\WINNT\system32\nnr.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Nothing - {edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e} - C:\WINNT\system32\hp60BB.tmp
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

After doing this, reboot into safe mode and delete the following files (ya might have to unhide hidden folders to do this):

C:\WINNT\system32\nnr.dll
C:\WINNT\system32\hp60BB.tmp

Restart into normal mode after this, and run HJT and post a new log here, along with the spysweeper and ewido logs.

Thanks.

Member Avatar for tayspen

Lets not forget the SpyAxe variants...

Download smitRem.exe (), saving the file to your desktop. Double click it to extract the contents to a folder of it's own. Restart your computer in safe mode, logon to the user account that is infected, open the smitRem folder and double click the RunThis.bat file to start the tool. Follow the prompts on screen and allow disk cleanup to complete. Upon reboot, you can reset your desktop background.

ALos, fix these.


O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

O20 - Winlogon Notify: winprb32 - C:\WINNT\SYSTEM32\winprb32.dll

I know spysweeper may have taken it out. but just to be safe...

Member Avatar for 'Stein

(heh, musta missed those entries ;) Good catch tayspern :cheesy: )

Here, the link's broken for SmitRem. Instead, we'll use SmitfraudFix.

Please download (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Thanks.

Member Avatar for tayspen

And thanks for cathing my dead link :).

Member Avatar for Member #72909

Much thanks to both of you. I think the virus is gone! Just to be sure, here are the log files form HJT and ewido (I used spybot instead of spysweeper b/c I couldn't find a free version).

Thanks again,
Matt

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 9:29:03 AM, 4/22/2006
+ Report-Checksum: AAF7083C
+ Scan result:
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\eldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\erture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\erture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\omniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\omniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\tbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\erture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\juggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Cookies\remetrics[1].txt -> TrackingCookie.Coremetrics : Cleaned with backup

::Report End

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 9:11:21 AM, on 4/22/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
C:\Program Files\eFax Messenger 4.0\J2GTray.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator.SARA-HADIDPN96Y\Desktop\HiJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ED1184DA-E57E-4480-99D0-A16809037F54} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eSnips] "C:\Program Files\eSnips\ClientGW.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O20 - Winlogon Notify: winprb32 - winprb32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

Member Avatar for 'Stein

Yep, all clean except for one thing:

O20 - Winlogon Notify: winprb32 - winprb32.dll (file missing)

Fix that and you're good.

Now for everything else. SmitFraudfix is pretty pointless for anything other then SpyAxe etc, so I would take it off your computer. Ewido I would leave on, as it's a very good cleaner (NOTE: After 14 days or so, it'll tell ya that the free subscribtion has expired. However, the only things ya lose are automatic updates and a background guard--none of which are necessary. Rather, before scanning, be sure to manually update.)

Other then that, I see nothing else.

Glad we could help:)

Thanks.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.