Post Your Hijack This logs here. - Page 5

phathag · 20th May 2005, 10:24 PM

Well although i am administrator i did what ya said.
logged in as admin and did tha thing. no luck.
even changed permissions to enable deletion but still no good.

In the key "altnet" is another key called "dashboard" In that is 2 more called "messages" and "settings"
when you click on either of the later, even just the folder icon it comes up with an error and goes no further "error opening key"
anytime u try to delete any of those entries it simply says "cannot delete : error while deleting key"

also tried kazaabegone and although it found some registry entries and removed them... a further spybot scan still found Altnet...

gonna give up soon ya know!

looktall · 20th May 2005, 11:06 PM

can you modify the keys?

instead of deleting then entire key, try right clicking on it and selecting modify. then delete the value.

phathag · 21st May 2005, 6:49 PM

the altnet folder with the key inside it i can modify the value (initially no value set) and i can delete the value again. but cannot delete the folder or subfolders

The folder inside altnet is called dashboard. i can do the same with that

the are 2 folders inside this. one called messages and the other settings.

i cannot do anything with those. as soon as i click on the folder it pops up with "error opeing key"

lowey2002 · 24th May 2005, 11:56 AM

I need some help with trojan(?) removal. My up to date anti-vir is going crazy - every minute or so I am getting:

Quote:

WARNING: D:\WINDOWS\VRDFDPJBK.EXE Is the Trojan horse TR/Buddy.F!
WARNING: D:\WINDOWS\SYSTEM32\POLLER.EXE Is the Trojan horse TR/Agent.ABS!

The executable in D:\Windows is randomly generated and will return every time it is deleted.

A full anti-vir scan fails to find anything
Spybot fails to find anything
Adaware fails to find anything

I have done the usual google for this Buddy.F but cannot find anything useful.

I am using Firefox and have the all the latest Windows XP SP2 updates.

I got the infection from a self extracting executable file from bittorrent. The license agreement was from a mob called Metrix and I was concurrently infected with 180 search assistant (this was fixed with Symantec's removal tool)

Here my hijackthis log ... hope you can help

Logfile of HijackThis v1.99.1
Scan saved at 9:55:11 AM, on 24/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.exe
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
D:\Program Files\DU Meter\DUMeter.exe
D:\Program Files\AVPersonal\AVGNT.EXE
D:\Program Files\Valve\Steam\Steam.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Program Files\OpenOffice.org 1.9.79\program\soffice.exe
D:\Program Files\OpenOffice.org 1.9.79\program\soffice.BIN
D:\Program Files\AVPersonal\AVGUARD.EXE
D:\Program Files\AVPersonal\AVWUPSRV.EXE
D:\WINDOWS\system32\CTsvcCDA.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\HijackThis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CTSysVol] D:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DU Meter] D:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Steam] D:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: OpenOffice.org 1.9.79.lnk = D:\Program Files\OpenOffice.org 1.9.79\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_02) -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - D:\WINDOWS\svcproc.exe (file missing)

lowey2002 · 24th May 2005, 12:12 PM

A reg search for nail.exe turned up:

[HKEY_LOCAL_MACHINE] [SOFTWARE] [MICROSOFT] [WINDOWS_NT] [CURRENT_VERSION] [WINLOGON]

reg_sz shell = Explorer.exe D:\Windows\nail.exe

I have deleted this entry and nail.exe but both keep coming back

lowey2002 · 24th May 2005, 12:25 PM

Downloaded ABIremover and ran it in safe mode. It has removed nail.exe

Is there anything else that shouldn't be here:

Logfile of HijackThis v1.99.1
Scan saved at 10:23:20 AM, on 24/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
D:\Program Files\DU Meter\DUMeter.exe
D:\Program Files\AVPersonal\AVGNT.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Valve\Steam\Steam.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Program Files\OpenOffice.org 1.9.79\program\soffice.exe
D:\Program Files\OpenOffice.org 1.9.79\program\soffice.BIN
D:\Program Files\AVPersonal\AVGUARD.EXE
D:\Program Files\AVPersonal\AVWUPSRV.EXE
D:\WINDOWS\system32\CTsvcCDA.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CTSysVol] D:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DU Meter] D:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Steam] D:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: OpenOffice.org 1.9.79.lnk = D:\Program Files\OpenOffice.org 1.9.79\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_02) -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe

looktall · 24th May 2005, 12:47 PM

i can't see anything suspicious in there now.

brodsta · 29th May 2005, 7:27 PM

hey, this is a log just taken now, sorry its so long could you's tell me if any of this looks out of place, i know that the second one (the http file in the second para) has somethin to do with that thirdinside.exe thing i posted a new thread about....

Code:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\taskmgr.exe
C:\DOCUME~1\Lance\LOCALS~1\Temp\lheuqviv.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\DRIVEP~1\THIRDI~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Symantec\LiveUpdate\LUALL.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\brodie\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.qvgvpmkrpjztlejav.uk/4XCZ...Lmzx37_XI.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1172995F-07C0-81BC-4129-731A63646F05} - C:\DOCUME~1\Lance\APPLIC~1\TICKCD~1\owns flap.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [balmflaw] C:\DOCUME~1\Lance\APPLIC~1\POKEEA~1\mp3 global.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Firewall Client Connectivity Monitor.LNK = C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT 98\AcDcToday.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5D3BDA-9559-425A-882C-08998C3A7F2E}: NameServer = 203.49.70.20 139.134.2.190
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[looktall edit: added code tags]

looktall · 29th May 2005, 7:39 PM

i see you have messenger plus installed.
one of the ways the creator pays for that is to include an optional searchbar and other spyware component. during the install process you would have been asked if you wanted to install it or not. most people don't even read it and click yes to install it.

i'm not even going to attempt to tell you which entries to remove via HJT until you have uninstalled messenger plus and re-run HJT.
the only way to remove the spyware that comes in with messenger plus properly is to uninstall messenger plus.
i suspect you'll find that most, if not all of your spyware disappears along with messenger plus.

if you still want to use messenger plus, simply reinstall it but read what you're clicking yes to.
it will work perfectly fine without installing the spyware.

brodsta · 29th May 2005, 7:52 PM

okay thanks for the tips,,to be honest i only got messenger plus so i could use the coloured nickname plugin lmao (colornickv2),,,,,otherwise i use triallian or regular

brodsta · 29th May 2005, 7:58 PM

okay heres the new scan after uninstalling msnplus

Code:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\brodie\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vtfgvgwekwwbd.com/4XCZ/gb...Lmzx37_XI.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - Global Startup: Firewall Client Connectivity Monitor.LNK = C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT 98\AcDcToday.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5D3BDA-9559-425A-882C-08998C3A7F2E}: NameServer = 203.49.70.20 139.134.2.190
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

looktall · 29th May 2005, 8:06 PM

well that cleaned up most of it.

the only suspicious entry i can see in there now is that search bar entry.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vtfgvgwekwwbd.com/4XCZ/g...hLmzx37_XI.html

try removing that and see how it goes.

brodsta · 29th May 2005, 8:17 PM

okay this is the new log

Code:

Logfile of HijackThis v1.99.1
Scan saved at 8:14:02 PM, on 29/05/2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trillian\trillian.exe
C:\brodie\hijackthis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - Global Startup: Firewall Client Connectivity Monitor.LNK = C:\Program Files\Microsoft Firewall Client\ISATRAY.EXE
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT 98\AcDcToday.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5D3BDA-9559-425A-882C-08998C3A7F2E}: NameServer = 203.49.70.20 139.134.2.190
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

it looks like that really did clean it all up the that thirdinside unknown isnt in the processes anymore thanks heaps for the help...

brodsta · 31st May 2005, 4:19 PM

Quote:

i see you have messenger plus installed.
one of the ways the creator pays for that is to include an optional searchbar and other spyware component. during the install process you would have been asked if you wanted to install it or not. most people don't even read it and click yes to install it.

would that be the optional 'sponsor' support search bar thing in the installation?

looktall · 31st May 2005, 7:36 PM

yep. that's exactly what it is.

just click the " i refuse" option and the install will continue as normal, but without the spyware.

20th May 2005, 10:24 PM	#61
phathag Member Join Date: Sep 2002 Location: Sydney Posts: 805	Well although i am administrator i did what ya said. logged in as admin and did tha thing. no luck. even changed permissions to enable deletion but still no good. In the key "altnet" is another key called "dashboard" In that is 2 more called "messages" and "settings" when you click on either of the later, even just the folder icon it comes up with an error and goes no further "error opening key" anytime u try to delete any of those entries it simply says "cannot delete : error while deleting key" also tried kazaabegone and although it found some registry entries and removed them... a further spybot scan still found Altnet... gonna give up soon ya know! __________________ EP45-UD3P \|\| E8400 @3.6GHz \|\| Zalman 7700Cu \|\| G.Skill 8800CL5D-4GBPI \|\| XFX 4890 1GB\|\| Raid 0 250GB 7200.8 [OS] \|\| Raid 1 WD 1.0 TB Sata [storage] \|\| Antec P160\|\| QFan 850W\|\| 24" LCD\|\| Win 7 64bit Ult DeviantART photo gallery website \|\| Folding@Home 2 Million Points Milestone

20th May 2005, 11:06 PM	#62
looktall Working Class Hero Join Date: Sep 2001 Location: morley.wa.au Posts: 17,931	can you modify the keys? instead of deleting then entire key, try right clicking on it and selecting modify. then delete the value. __________________ JoJoker endorses this product and/or comment.

21st May 2005, 6:49 PM	#63
phathag Member Join Date: Sep 2002 Location: Sydney Posts: 805	the altnet folder with the key inside it i can modify the value (initially no value set) and i can delete the value again. but cannot delete the folder or subfolders The folder inside altnet is called dashboard. i can do the same with that the are 2 folders inside this. one called messages and the other settings. i cannot do anything with those. as soon as i click on the folder it pops up with "error opeing key" __________________ EP45-UD3P \|\| E8400 @3.6GHz \|\| Zalman 7700Cu \|\| G.Skill 8800CL5D-4GBPI \|\| XFX 4890 1GB\|\| Raid 0 250GB 7200.8 [OS] \|\| Raid 1 WD 1.0 TB Sata [storage] \|\| Antec P160\|\| QFan 850W\|\| 24" LCD\|\| Win 7 64bit Ult DeviantART photo gallery website \|\| Folding@Home 2 Million Points Milestone

24th May 2005, 12:12 PM	#65
lowey2002 Member Join Date: Jan 2002 Location: Perth WA Posts: 429	A reg search for nail.exe turned up: [HKEY_LOCAL_MACHINE] [SOFTWARE] [MICROSOFT] [WINDOWS_NT] [CURRENT_VERSION] [WINLOGON] reg_sz shell = Explorer.exe D:\Windows\nail.exe I have deleted this entry and nail.exe but both keep coming back __________________ ...

24th May 2005, 12:25 PM	#66
lowey2002 Member Join Date: Jan 2002 Location: Perth WA Posts: 429	Fixed Downloaded ABIremover and ran it in safe mode. It has removed nail.exe Is there anything else that shouldn't be here: Logfile of HijackThis v1.99.1 Scan saved at 10:23:20 AM, on 24/05/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\Program Files\D-Tools\daemon.exe D:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe D:\Program Files\DU Meter\DUMeter.exe D:\Program Files\AVPersonal\AVGNT.EXE D:\Program Files\iTunes\iTunesHelper.exe D:\Program Files\QuickTime\qttask.exe D:\Program Files\Valve\Steam\Steam.exe D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe D:\Program Files\OpenOffice.org 1.9.79\program\soffice.exe D:\Program Files\OpenOffice.org 1.9.79\program\soffice.BIN D:\Program Files\AVPersonal\AVGUARD.EXE D:\Program Files\AVPersonal\AVWUPSRV.EXE D:\WINDOWS\system32\CTsvcCDA.exe D:\WINDOWS\system32\MsPMSPSv.exe D:\Program Files\iPod\bin\iPodService.exe D:\Program Files\HijackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CTSysVol] D:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [DU Meter] D:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [Steam] D:\Program Files\Valve\Steam\\Steam.exe -silent O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - Startup: OpenOffice.org 1.9.79.lnk = D:\Program Files\OpenOffice.org 1.9.79\program\quickstart.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_02) - O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) - O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) - O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Program Files\AVPersonal\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe __________________ ...

24th May 2005, 12:47 PM	#67
looktall Working Class Hero Join Date: Sep 2001 Location: morley.wa.au Posts: 17,931	i can't see anything suspicious in there now. __________________ JoJoker endorses this product and/or comment.

29th May 2005, 7:39 PM	#69
looktall Working Class Hero Join Date: Sep 2001 Location: morley.wa.au Posts: 17,931	i see you have messenger plus installed. one of the ways the creator pays for that is to include an optional searchbar and other spyware component. during the install process you would have been asked if you wanted to install it or not. most people don't even read it and click yes to install it. i'm not even going to attempt to tell you which entries to remove via HJT until you have uninstalled messenger plus and re-run HJT. the only way to remove the spyware that comes in with messenger plus properly is to uninstall messenger plus. i suspect you'll find that most, if not all of your spyware disappears along with messenger plus. if you still want to use messenger plus, simply reinstall it but read what you're clicking yes to. it will work perfectly fine without installing the spyware. __________________ JoJoker endorses this product and/or comment.

29th May 2005, 8:06 PM	#72
looktall Working Class Hero Join Date: Sep 2001 Location: morley.wa.au Posts: 17,931	well that cleaned up most of it. the only suspicious entry i can see in there now is that search bar entry. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vtfgvgwekwwbd.com/4XCZ/g...hLmzx37_XI.html try removing that and see how it goes. __________________ JoJoker endorses this product and/or comment.

31st May 2005, 7:36 PM	#75
looktall Working Class Hero Join Date: Sep 2001 Location: morley.wa.au Posts: 17,931	yep. that's exactly what it is. just click the " i refuse" option and the install will continue as normal, but without the spyware. __________________ JoJoker endorses this product and/or comment.