:sad:
Hi,
My PC had recently been attacked by HackTool.Rootkit virus. I went through some of the instructions that were posted in this forum and was able to remove it partially. But the virus is still lurking somewhere in my PC and i'm unable to remove it completely. Well, here's what i've done till now -
- I've installed MS Anti-Spyware (Beta) and removed all spyware from my comp.
- I found out that msdirectx.sys was the troublemaker and removed all occurrances of it from the registry and deleted all physical instances of the file too.
- I've run all the possible antivirus programs available - Stinger, AVG, NAV, McAfee 2005 - but in vain.
The problem now is that some malicious process shows up in my task manager (see HijackThis log below) called bwgo0000*.exe. I kill it each time and delete the program from the %temp% dir, but each time i reboot the system, it shows up again and tries to connect to the internet. Please help...!!
Logfile of HijackThis v1.99.1
Scan saved at 9:05:28 AM, on 5/13/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
E:\Program Files\Logitech\Video\LogiTray.exe
E:\Program Files\Microsoft AntiSpyware\gcasServ.exe
E:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.Exe
E:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
E:\DOCUME~1\Adithya\LOCALS~1\Temp\bwgo0000bee6.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\McAfee\Managed VirusScan\VScan\McShield.exe
E:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
D:\Downloads\HijackThis.exe
E:\WINDOWS\System32\rasautou.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] E:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] E:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] E:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [McAfee Managed Services Tray] E:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.Exe
O4 - HKLM\..\Run: [MVS Splash] E:\Program Files\McAfee\Managed VirusScan\VScan\Splash.exe
O4 - HKCU\..\Run: [LDM] E:\Program Files\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger Agent.lnk = E:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Download with &DAP - E:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - E:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - E:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_4us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41174515-8D66-4B49-82FD-6EDED8F5CCF5}: NameServer = 202.144.95.4,202.144.66.6
O18 - Protocol: bw+0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Program Files\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - E:\Program Files\McAfee\Managed VirusScan\Agent\myRmProt3.0.0.624.dll
O18 - Protocol: offline-8876480 - {EFB3559C-6EEF-4748-A86F-EFA5CBBE25B9} - E:\Program Files\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: McShield - Network Associates, Inc. - E:\Program Files\McAfee\Managed VirusScan\VScan\McShield.exe
O23 - Service: McAfee Managed Services Agent (myAgtSvc) - McAfee, Inc. - E:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe
Thanks in advance :)