Member Avatar for Foster

Thanks for the helpful replies, folks. After spending the better part of this morning going through my windows files, I found a little exe called, isInstall. When I tried to scan it with Norton, it crashed windows. Upon restarting, I get a popup warning me that a "malicious script was detected and removed". The trojan was, isInstall.exe

So I did a full system scan again, and Norton didn't hang-up in the intuit\shared file any longer. Windows also shuts down and restarts normally. :cheesy:

I hate to post another thread in the security forum, so maybe a moderator could move this? I ran HighJack, and this is my log;

Logfile of HijackThis v1.98.0
Scan saved at 8:07:44 PM, on 7/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\kbjvgf.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\HCPC.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\uickTimeVRQ.exe
C:\WINDOWS\System32\ASSERR.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Bethesda Softworks\Morrowind\TES Construction Set.exe
C:\WINDOWS\System32\ti2evxxa.exe
C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
C:\WINDOWS\System32\BDUSRK.exe
C:\Documents and Settings\Eric\My Documents\My Downloads\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [exthybr] C:\WINDOWS\System32\kbjvgf.exe
O4 - HKLM\..\Run: [HCPC] C:\WINDOWS\System32\HCPC.exe
O4 - HKLM\..\Run: [uickTimeVRQ] C:\WINDOWS\System32\uickTimeVRQ.exe
O4 - HKLM\..\Run: [ASSERR] C:\WINDOWS\System32\ASSERR.exe
O4 - HKLM\..\Run: [ti2evxxa] C:\WINDOWS\System32\ti2evxxa.exe
O4 - HKLM\..\Run: [BDUSRK] C:\WINDOWS\System32\BDUSRK.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Check for OneTouch Updates.lnk = C:\Program Files\Visioneer OneTouch\WiseUpdt.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O15 - Trusted Zone:
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://www.atex.cc/dm/cax.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) -
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D53CF19-42B1-4867-BE8D-41D15CB4BEBF}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D53CF19-42B1-4867-BE8D-41D15CB4BEBF}: NameServer =

The 04 HKLM lines in bold I find suspicious, but I really have no idea what I'm looking at. Are these actual problems?

Again, thanks for the help.

  • 2 Contributors
  • 1 Reply
  • 189 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

’s follow-up shows the immediate symptom — an in-folder executable made the AV crash and removing it restored normal shutdown. That is encouraging, but an AV crash during scan often means a resident component (driver or rootkit) was protecting itself. Successful deletion plus a normal shutdown is not proof of full cleanup; further verification steps are important.

Boot to Safe Mode and run multiple, up-to-date scanners. Use a second-opinion scanner in addition to the installed AV, and if available scan from bootable rescue media so the OS is not active. Use an advanced startup inspector (Autoruns) to enumerate and export all startup points, scheduled tasks and drivers; export backup copies of the registry or create a restore point before making changes. Run targeted rootkit checks (for example, dedicated rootkit utilities) if symptoms persist. Verify system file integrity with sfc /scannow and inspect Event Viewer and netstat -ano for unusual services or outbound connections. After a confirmed clean, delete old System Restore points (they can contain reinfection) and create a fresh, clean restore point. From a clean machine, change all passwords used on the infected system.

Follow the spirit of ’s advice to rescan in Safe Mode and remove startup/run items, but avoid blind use of "fix checked" without researching entries. Save a fresh diagnostic log before and after each cleanup step so changes can be compared. If a persistent boot-level compromise is found, or if sensitive credentials or data were present, prefer a full reinstall from known-good media and restore user files only after scanning them separately.

Note: Windows XP reached end of official support on April 8, 2014, so migrating to a supported OS is strongly recommended to avoid future unpatched risks.

Member Avatar for crunchie

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)

O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [exthybr] C:\WINDOWS\System32\kbjvgf.exe
O4 - HKLM\..\Run: [HCPC] C:\WINDOWS\System32\HCPC.exe
O4 - HKLM\..\Run: [uickTimeVRQ] C:\WINDOWS\System32\uickTimeVRQ.exe
O4 - HKLM\..\Run: [ASSERR] C:\WINDOWS\System32\ASSERR.exe
O4 - HKLM\..\Run: [ti2evxxa] C:\WINDOWS\System32\ti2evxxa.exe
O4 - HKLM\..\Run: [BDUSRK] C:\WINDOWS\System32\BDUSRK.exe

O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://www.atex.cc/dm/cax.cab

Reboot into safe mode following the instructions & navigate to & delete the following if found:

C:\WINDOWS\realtime.exe
C:\WINDOWS\System32\kbjvgf.exe
C:\WINDOWS\System32\HCPC.exe
C:\WINDOWS\System32\uickTimeVRQ.exe
C:\WINDOWS\System32\ASSERR.exe
C:\WINDOWS\System32\ti2evxxa.exe
C:\WINDOWS\System32\BDUSRK.exe

Reboot normally after doing the above then post a fresh log please.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.