Backdoor.IRC.Loonbot removal?

Question

Hello, Norton Anti Virus found a virus on my computer but is not able to remove it. I get the following Virus Alert messge on my computer:

Norton Anti Virus has detected a virus on your computer

Object name: C:\WINDOWS\System32\messenger.exe

Virus name: Backdoor.IRC.Loonbot

Action Taken: Unable to repair this file

When I click on OK, or try to close the dialog box, the Action Taken message says "Access to the file was denied".

I have tried the following things to get rid of this virus, all without success:

1) Disabled System Restore in Windows xp

2) Updated my Norton virus definitions

3) Ran a full system scan -- it found the file again (message.exe) but could not fix it

I also tried deleting the file using Windows Explorer, but when I right click on the file and select Delete, I get an error message that says "Cannot delete messenger - access is denied"

Thanks in advance for any help!

ChrisRLG · Answer

Jump to the hijackthis instructions below
==============
On my site (Link Below) try the AV section and one of the online virus checkers, such as housecall. You could try McAfee's stinger too From Here

If that does not work try the malware route.
Use these to remove Malware (Virus, Spyware and Adware).

First :-
Spybot S&D and Ad-aware using the settings and links provided
Here

Failing those solving your problems a post of a hijackthis log for the experts to advise.
HijackThis From Here
or one of these other links:-
http://www.merijn.org/files/hijackthis.zip
http://www.aluriasoftware.com/tools/hijackthis.zip
http://mjc1.com/mirror/hjt/

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. Unzip HijackThis into this folder. (See this link for graphical instructions)
Then run, scan, save log, then in notepad copy the FULL log by copy and paste as a reply to this post and an expert with HijackThis Knowldge, will have a go at giving advice. A lot of posters make mistakes here in copying and pasting so reread the left info sidebar called Copy and Paste
Please note the list of experts names below, very few forum regulars here have had this training.

DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.

Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.

TomCoyote (of http://tomcoyote.org/forums/index.php fame)
YoKenny (Expert at TomCoyotes, Trusted Advisor Spywareinfo)
baskar1234 (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
ChrisRLG (Classroom Coordinator at TomCoyotes, Trusted Advisor Spywareinfo)
Tuxedo Jack (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
Yellowhammer (Trusted Advisor at Net-Integration, First Responder at Computer Cops)
tashi (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
therock247uk (In Training at TomCoyotes and Spywareinfo)
irelynmisses (In Training at TomCoyotes and Spywareinfo)
Texruss (Spyware Fighter at Wildersecurity, In Training at TomCoyotes)
PGPhantom (Trusted Advisor at Spywareinfo)

You could also go to one of the more specalist forums where more experts will be able to help.
http://tomcoyote.com/forums/index.php
http://forums.spywareinfo.com/index.php
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi (Home of Spybot S&D)
http://boards.cexx.org/index.php
http://www.wilderssecurity.com/index.php
Do read the sites FAQ before posting, and advise your problem and what steps you have already done to try to cure your problem.

I, and the other hijack experts mentioned above, are in all those sites (and more) with the same login names. You might get one of us at those sites also to anwser your log, but other experts will also be available.

k3td · Answer

Here is the log after I removed messenger.exe: Logfile of HijackThis v1.97.7Scan saved at 7:29:57 PM, on 5/15/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\brsvc01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\brss01a.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton Internet Security\NISUM.EXEC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\BroadJump\Client Foundation\CFD.exeC:\program files\support.com\bin	gcmd.exeC:\Program Files\Winamp\Winampa.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Yahoo!\browser\ybrwicon.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\Program Files\Scansoft\PaperPort\pptd40nt.exeC:\Program Files\DIGStream\digstream.exeC:\Program Files\Digital Line Detect\DLG.exeC:\PROGRA~1\Yahoo!\browser\ycommon.exeC:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exeC:\Program Files\SBC\Connection Manager\CManager.exeC:\Program Files\Creative\SBLive\Diagnostics\diagent.exeC:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\SYSTEM32\Brmfrmps.exeC:\Program Files\Norton Internet Security\ccPxySvc.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\System32\BRMFRSMG.EXEC:\Program Files\Netscape\Netscape\Netscp.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\cidaemon.exeC:\WINDOWS\system32\cidaemon.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32undll32.exeC:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://yahoo.sbc.com/dslO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [diagent] 'C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe' startupO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [ConMgr.exe] 'C:\Program Files\EarthLink 5.0\ConMgr.exe'O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exeO4 - HKLM\..\Run: [tgcmdprovidersbc] 'c:\program files\support.com\bin	gcmd.exe' /server /startmonitor /deaf /nosystrayO4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\Winampa.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exeO4 - HKLM\..\Run: [IPInSightMonitor 02] 'C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe'O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exeO4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\BRMFLPRO\BrDefPrt.exeO4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exeO4 - Startup: Connection Manager.lnk = C:\Program Files\SBC\Connection Manager\CManager.exeO4 - Global Startup: Adobe Gamma Loader.lnk = ?O4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: SmartUI.lnk = ?O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra button: Yahoo! Login (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: AIM (HKLM)O9 - Extra button: MoneySide (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O12 - Plugin for .vcs: C:\Program Files\Netscape\Communicator\Program\PLUGINS
pvcal32.dllO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dllO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/178f4907fa7aafd71121/netzip/RdxIE601.cabO16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CABO16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dllO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dllO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2305CC79-4FE3-4A8D-A39D-5DF827492B08}: NameServer = 151.164.1.8 151.164.30.105O17 - HKLM\System\CS1\Services\Tcpip\..\{2305CC79-4FE3-4A8D-A39D-5DF827492B08}: NameServer = 151.164.1.8 151.164.30.105

k3td · Answer

Hijackthis worked - thanks! I downloaded it and ran it per your instructions.  Then I searched the log and found message.exe, and got rid of it. Thanks ChrisRLG!

ChrisRLG · Answer

Please post the hijackthis log as a reply here - Dont try fixing anything without advise.

Texruss · Answer

In Hijackthis scan, and check the box to the left of the following items:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: SmartUI.lnk = ?
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/178f4907fa7aafd71121/netzip/RdxIE601.cab

With no other windows open, click on fix checked button in Hijackthis.

Reboot in Safe Mode and enable Hidden Files:

FAQ 8 and 9 on this page: http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

Open Windows Explorer: type the word explorer at Start/Run box and click OK:

Drill on down and delete the following files if present:

C:\WINDOWS\SYSTEM\blank.htm
C:\WINDOWS\messenger.exe

Reboot in normal mode Windows and run Disk Cleaner: type cleanmgr at Start/Run. Scan all hard drives and check all categories at the end and click OK.

Browse a bit and post a fresh hijackthis log.

All the best,

Texruss

k3td · Answer

Done - thanks! Logfile of HijackThis v1.97.7Scan saved at 8:11:17 AM, on 5/16/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\brsvc01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\brss01a.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton Internet Security\NISUM.EXEC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\SYSTEM32\Brmfrmps.exeC:\Program Files\Norton Internet Security\ccPxySvc.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\BroadJump\Client Foundation\CFD.exeC:\program files\support.com\bin	gcmd.exeC:\Program Files\Winamp\Winampa.exeC:\WINDOWS\System32\BRMFRSMG.EXEC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Yahoo!\browser\ybrwicon.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\Program Files\Scansoft\PaperPort\pptd40nt.exeC:\Program Files\DIGStream\digstream.exeC:\Program Files\SBC\Connection Manager\CManager.exeC:\PROGRA~1\Yahoo!\browser\ycommon.exeC:\Program Files\Creative\SBLive\Diagnostics\diagent.exeC:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exeC:\Program Files\Netscape\Netscape\Netscp.exeC:\hijackthis\HijackThis.exeC:\Program Files\Messenger\msmsgs.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http ://dsl.sbc.yahoo.com/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http ://yahoo.sbc.com/dslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dslR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://yahoo.sbc.com/dslO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C: \Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C: \Program Files\Microsoft Money\System\mnyside.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C: \PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C: \Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C: \WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [diagent] 'C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe' startupO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask. exe' -atboottimeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [ConMgr.exe] 'C:\Program Files\EarthLink 5.0\ConMgr. exe'O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exeO4 - HKLM\..\Run: [tgcmdprovidersbc] 'c:\program files\support. com\bin	gcmd.exe' /server /startmonitor /deaf /nosystrayO4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\Winampa.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon. exeO4 - HKLM\..\Run: [IPInSightMonitor 02] 'C:\Program Files\SBC Yahoo! \Connection Manager\IP InSight\IPMon32.exe'O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exeO4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\BRMFLPRO\BrDefPrt.exeO4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exeO4 - Startup: Connection Manager.lnk = C:\Program Files\SBC\Connection Manager\CManager.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra button: Yahoo! Login (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: AIM (HKLM)O9 - Extra button: MoneySide (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O12 - Plugin for .vcs: C:\Program Files\Netscape\Communicator\Program\PLUGINS
pvcal32.dllO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dllO16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CABO16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dllO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData. dllO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/ swflash.cabO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2305CC79-4FE3-4A8D-A39D-5DF 827492B08}: NameServer = 151.164.1.8 151.164.11.201O17 - HKLM\System\CS1\Services\Tcpip\..\{2305CC79-4FE3-4A8D-A39D-5DF 827492B08}: NameServer = 151.164.1.8 151.164.11.201

Texruss · Answer

Great job! You got rid of RedSwoosh (those red.clientapps entries). How about messenger.exe? Was it there when you looked in Safe Mode? Texruss

k3td · Answer

I was able to delete messenger.exe from the C:\WINDOWS\System32 folder the first time I ran hijackthis. I did search for it again in Safe Mode after I enabled the hidden files, but wasn't able to find anything.

Thank you!

Texruss · Answer

OK...thanks for the detective work...we like learning how these malware apps behave. They sometimes do get get totally deleted from a Hijackthis fix, sometimes not and then we must manually delete the file.

All the best,

Texruss

Virus & Spyware

Backdoor.IRC.Loonbot removal?

Was this post helpful?