find4u.net - hijackthis log

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary. Please delete the old copy so it can't be used.
----------------------
Check these in hijackthis, AND WITH ALL OTHER WINDOWS CLOSED, fix checked.

Any R0/R1 that you dont wish to keep as home/search pages.

O4 - Global Startup: winlogon.exe
O4 - HKLM\..\RunServices: [Configuration Loader] SERVlCES.exe

The following activeX controls will reinstall when(and if) you revisit that website, UNLESS you know they are from a safe source, check to remove.

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx

Then Reboot to safe mode (F8 on boot) and delete the following files/folders:-

File > > c:\windows\winlogon.exe (NOT the MS legit file at c:\windows\system32\winlogon.exe)
File > > c:\windows\system32\SERVlCES.exe

Then Reboot and post a fresh log for me to check.

There is no SERVlCES.exe on my WinXP system

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.M

File > > c:\windows\system32\SERVlCES.exe

Chris, are you sure about that one? On my Win2K system, the legitimate copy of services.exe is in the system32 directory!

Jim

YoKenny,

Thanks for checking that! I have Win2K, and was very surprised to learn that XP doesn't have that executable.

(edit) This is a case where sans serif fonts are not your friend! Look at this in "courier new": SERVlCES.exe

That makes the problem clear! The trojan is called SERVlCES.exe, and the legit one SERVICES.exe

I like TrendMicro's note about this: (Note that SERVlCES.EXE is spelled as s-e-r-v-l-c-e-s.)

Jim

Message Edited by jimw on 02-18-2004 05:31 PM

Thanks for all the help - I think it is all better now (see updated log below).

I have another minor issue.  I was trying out some tweaks for XP (from this page:  http://www.blackviper.com/WinXP/servicecfg.htm )  and inadvertently (stupidly) turned off the item in the services.msc menu that allows me to save passwords.  A pretty neat security feature - but it gets really annoying re-typing passwords all the time - anyone know how to turn that back on?

 

Logfile of HijackThis v1.97.7
Scan saved at 9:39:05 PM, on 02/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\svchost.exe
C:\HJT\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab

 

Have a look at http://www.blackviper.com/WinXP/service411.htm#Protected_Storage 

Thanks YoKenny - that is definitely it.  Unfortunately I can't seem to access services.msc anymore.  When I type it in to the run field it just tells me 'Windows can not find services.msc'.  I am logged in with administrative privileges, and have edited services from this user account - however now it is gone.  Any viruses out there that change the name of services.msc?

There are viruses/worms that disable regedit and Task Manager so disabling services.msc is not above suspicion.

C:\Windows\system32\services.msc is the location on my system.

You may have to run a safe recovery from your WinXP CD to recover the file.

You may want to boot into Safe Mode by repeatedly tapping F8 at reboot and go to the source folder in a DOS window and copy services.msc to services1.msc then run this.

The virus/worm authors are becoming more malicious with each passing day/hour.