Help Please

Question

I was on here before for my own computer.. my little brothers has been acting up as well.. his desktop paper has disappeared and it said its because of a virus.. but the antivirus we have doesnt seem to detect it. He ran ad-aware and spybot but it still hasnt changed. here is his Hijack this log. please help.

Logfile of HijackThis v1.99.1
Scan saved at 10:23:52 AM, on 4/14/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\ACCELERATION SOFTWARE\ANTI-VIRUS\STOPSIGNAV.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\WINDOWS\APPLICATION DATA\EETS.EXE
C:\WINDOWS\SYSTEM\WVYB.EXE
C:\WP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\DESKTOP\HT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {699ACC1D-5AF8-0601-D589-544035E8FD94} - C:\WINDOWS\SYSTEM\NCAU.DLL (file missing)
O2 - BHO: (no name) - {F9887CBB-E906-E1F3-2456-E95B24286097} - C:\WINDOWS\SYSTEM\DVLMVO.DLL
O2 - BHO: (no name) - {2A541301-A949-11D9-B883-00C0EAB11C31} - C:\WINDOWS\SYSTEM\FNDJ.DLL (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [ufwksd] c:\windows\system\ufwksd.exe
O4 - HKLM\..\Run: [mcappins.exe] "D:\VSC\ENU\mcappins.exe" vsocfg.ini
O4 - HKLM\..\Run: [webscan] C:\PROGRAM FILES\ACCELERATION SOFTWARE\ANTI-VIRUS\STOPSIGNAV.EXE -k
O4 - HKLM\..\Run: [sginst] C:\PROGRA~1\ACCELE~1\SCRIPT~1\SGINST.EXE /upd
O4 - HKLM\..\Run: [dguard] C:\PROGRAM FILES\ACCELERATION SOFTWARE\DOWNLOADGUARD\DGUARD.EXE
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Panda Preventium+ Service] "C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2004\PREVSRV.EXE"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Hmur] C:\WINDOWS\Application Data\eets.exe
O4 - HKCU\..\Run: [Ekob] C:\WINDOWS\SYSTEM\wvyb.exe
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra button: Microsoft AntiSpyware helper - {2ECF8900-A949-11D9-B883-00C04F77C128} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2ECF8900-A949-11D9-B883-00C04F77C128} - (no file) (HKCU)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.nielsennetpanel.com/netmeter4_6/NetMeter_preinstaller_activex_en_4.60.38.0_MEGAPANEL_USA.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O18 - Filter: text/html - {2A541300-A949-11D9-B883-00C085FDB9AA} - C:\WINDOWS\SYSTEM\FNDJ.DLL
O18 - Filter: text/plain - {2A541300-A949-11D9-B883-00C085FDB9AA} - C:\WINDOWS\SYSTEM\FNDJ.DLL

cghost · Answer

Hi:

I had been hoping someone else would pick this up. My problem is time. I am going to give you some suggestions to get started, I will probably not be able to be back before tuesday.

--------------------------
These four lines look suspect to me but I do not have the time to research them right now.

Google for Kaspersky. You will get a selection for kaspersky antivirus. You can submit each of these files for a review. For any of them that come back as infected files, you should fix the associated line in hijackthis and then delete the file.

If the file deletion causes problems, try first going to safemode. If that does not work you can go to a downloads page at subratam.org and get a program called killbox.

O4 - HKLM\..\Run: [ufwksd] c:\windows\system\ufwksd.exe
O4 - HKCU\..\Run: [Hmur] C:\WINDOWS\Application Data\eets.exe
O4 - HKCU\..\Run: [Ekob] C:\WINDOWS\SYSTEM\wvyb.exe
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
--------------------------

The other thing that I think is going on is a coolwebsearch/about:blank issue. These steps should help with that:

=Download CW-Shredder at the link below:
http://cwshredder.net/bin/CWShredder.exe

=Download SpSeHjfix for windows 95-98-ME:
http://www.trojaner-info.de/anleitungen...blank.html

to the desktop.
Then right click a blank part of desktop & select new folder, call it spfix
unzip the file into that folder

=Disconnect from the net and Close ALL OPEN PROGRAMS.

=Backup the registry to give a recovery point in case there is a problem.
** How to: http://support.microsoft.com/kb/256419/EN-US/

=Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the folder.

If it doesn't find any of the SE files or any hidden reinstallers it will say system clean and not go on to next stage

=Now run the Shredder - Hit The FIX button!

=Start hijackthis and fix any of these lines that remain:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {699ACC1D-5AF8-0601-D589-544035E8FD94} - C:\WINDOWS\SYSTEM\NCAU.DLL (file missing)
O2 - BHO: (no name) - {F9887CBB-E906-E1F3-2456-E95B24286097} - C:\WINDOWS\SYSTEM\DVLMVO.DLL
O2 - BHO: (no name) - {2A541301-A949-11D9-B883-00C0EAB11C31} - C:\WINDOWS\SYSTEM\FNDJ.DLL (file missing)
O18 - Filter: text/html - {2A541300-A949-11D9-B883-00C085FDB9AA} - C:\WINDOWS\SYSTEM\FNDJ.DLL
O18 - Filter: text/plain - {2A541300-A949-11D9-B883-00C085FDB9AA} - C:\WINDOWS\SYSTEM\FNDJ.DLLL

=Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'

---------------------------------

Another problem scanning tool that you can use is this:
http://www.mwti.net/antivirus/mwav.asp
It takes awhile to download and awhile to run, so particularly if you are on dialup, it might not be something you want to do.

I am sorry I cant spend more time on the file analysis right now, but I think this will get you some relief on the computer.

Regards.
cg

MissNikkiLee · Answer

i tried running SpSeHjfix overnight and it remained at the same screen.. im not sure if its supposed to do that or it just wasnt working. just let me know and i can run that... i did everything else besides that and running the shredder.. on his desktop.. the wallpaper is still missing and it says "A fatal error in IE has occured at 0028:c0011E36 in VXD VMM<01> + 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.com"

and a few things under. if you can help with that id appreciate it. i appologize for taking so long but i had been away on vacation

MissNikkiLee · Answer

also, i went to run this http://www.mwti.net/antivirus/mwav.asp and it found stuff.. but you have to buy it for it to do something.. and i dont have the $60 to throw out :z

cghost · Answer

Hi,

I don't know what is going on with the fix program.

A different approach:

Download: "StartDreck", from here:
http://www.niksoft.at/download/startdreck.htm
or here:
http://www.greyknight17.com/download.htm
(under anti-spyware and anti-hijack applications)

Unzip to its own folder and start the program,
Press 'Config'
Press 'Unmark All'
Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'
Press 'Save' and select the location to save the log file
(default is the same folder as the application)

Please post the log in this thread.

Please also post a new hijackthis log so I can see what it looks like now.

Regards.

cg

Virus & Spyware

Help Please

Was this post helpful?