Member Avatar for lfisher17

I have malware that keeps changing my LAN settings to "Use auto config script "http://127.0.0.1:8080/proxyconf". I have read Crunchie's "how i got infected" & followed all his advice, have run AdAware and SpyBot (and will run spywareblaster in future), but they don't permanently remove the malware, as the above proxy keeps getting reinstalled. I was dumb/ignorant and had my IE security settings set too low (won't do THAT again!). Below is my HijackThis log, Please Help! Thanks!!

Logfile of HijackThis v1.97.7
Scan saved at 1:41:46 PM, on 5/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\Sonysys\VAIO Recovery\reminder.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\program files\support.com\client\bin\tgcmd.exe
C:\WINDOWS\System32\ICO.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WebWasher\wwasher.exe
C:\Documents and Settings\L\Local Settings\Temp\Temporary Directory 1 for hijackthis_v_1_97.zip\HijackThis.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.refdesk.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.refdesk.com"); (C:\Documents and Settings\L\Application Data\Mozilla\Profiles\default\asejhfbs.slt\)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\L\Application Data\Mozilla\Profiles\default\asejhfbs.slt\)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CreateCD_Reminder] C:\WINDOWS\Sonysys\VAIO Recovery\reminder.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Billminder.lnk = C:\Program Files\Quicken\billmind.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\Quicken\QWDLLS.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to filterlist (WebWasher) -
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: Tarantella 3.x Framework Java Archive -
O16 - DPF: Tarantella 3.x Proxy Java Archive -
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) -
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

  • 3 Contributors
  • 3 Replies
  • 255 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Quick summary and context: the mention of "..." means your system is configured to use a PAC/auto-config file served from the loopback address — in other words a local process is telling Windows to route HTTP through a proxy on 127.0.0.1:8080. That behavior can come from legitimate tools (Fiddler, some VPN/proxy/monitoring apps) or from adware/malware that installs a local proxy. (stackoverflow.com)

Practical first steps (safe, diagnostic): identify the process listening on port 8080 before deleting anything. Run this from an elevated command prompt:

netstat -ano | findstr :8080
tasklist /FI "PID eq <PID-from-netstat>"

Or use Sysinternals TCPView to get the process name and path in a GUI. Do not kill unknown system PIDs (e.g. PID 4). Once you know the executable, check its file location and digital signature before removing it. (stackoverflow.com)

Remove persistence and the PAC entry: use Autoruns to inspect Run, Services, Scheduled Tasks, BHOs and Winsock providers (it shows all common autostart locations). If the local proxy is started at boot, Autoruns will point to the registry/service/file to disable or delete. After removing the offending autostart, delete the AutoConfigURL registry value (this clears the "Use automatic configuration script" field) and reboot. Back up the registry first. Example registry removal (run as the affected user):

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /f

(learn.microsoft.com)

Cleanup and hardening: reset Winsock (clears LSP/proxy hooks) and reboot:

netsh winsock reset
shutdown /r /t 0

Then run up-to-date offline/online scanners (Malwarebytes, Microsoft Defender Offline or an online scanner) and upload any suspicious binaries to VirusTotal for quick multi-engine checks. If a local proxy process is legitimate, uninstall or reconfigure it instead of deleting arbitrarily. If the proxy keeps returning after all these steps, consider an offline rescue scan or a clean OS install. (howtogeek.com)

Notes on forum replies: ’s advice to check BHOs/hosts was a good start; add the port-listener and Autoruns checks above. Claims naming individuals () are not helpful for removal — focus on technical indicators (file path, PID, signatures, AV detections) when deciding whether to remove or reimage.

Recommended Answers

All 3 Replies

Member Avatar for crunchie

Unzip HJT into it's own permanent folder before doing anything in order for it to create backups. (Not a temporary folder or the desktop & not directly on your hard drive). Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked' :

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Go to your *hosts* file & clear out any entries there that you find.

Member Avatar for ChesapeakeGal

This is the hallmark of a botherder out of Virginia who has been spamming, putting in botnets for over five years. The entry "lsasse" is a trojan, identified as an identity theft one.

He is in Williamsburg, VA and there is an active case with the FBI on him now. I will add to the post, but I STRONGLY suggest you file a complaint with the IC3 and mention the handle "2jessie" who hangs out on the AdultFriendfinder site, Mature (Over 50) room.

Member Avatar for crunchie

Thanks, but I kind of think that after almost 3 1/2 years, the OP is not coming back :D

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.