Hi jack this lock posted as requested

Question

Hi log file posted for review. Edits, Posted this then realised I hadn't run the scans I have available. Sorry it's been a long week. Running  Adaware Plus, CW-Shredder, Spybot, Spywareblaster & Spyguard all in use NAV 2003, ZA5 Pro &  NAT netgear router. Dimension D4100 933 Mhz running Win XP pro and MS Office XP IE 6 with all updates up to and including update installed today at 18:00 GMT 512 MB RAM in two *256 133Mhz strips 120 GB & 80 GB HD's on Promise TX2 133 ATA card. No specific or known problems, computer is just a bit reluctant to boot fully and easily on first boot sometimes. Like me I suppose it is getting a bit long in the tooth and doesn't want to get up in the morning. My wife has promised I can look at a new machine soon. Thanks Ceri   Logfile of HijackThis v1.98.0Scan saved at 19:20:11, on 30/07/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\System32\DRIVERS\CDANTSRV.EXEC:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXEC:\WINDOWS\System32\inetsrv\inetinfo.exeC:\MSSQL7\binn\sqlservr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\System32
vsvc32.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\WINDOWS\System32\svchost.exec:\program files\sophos AV sweep\SWNETSUP.EXEC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\MSSQL7\binn\sqlagent.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\SpywareGuard\sgmain.exeC:\Program Files\SpywareGuard\sgbhp.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Outlook Express\msimn.exeC:\Hijack this\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://crackspider.net/ie/sbar.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://crackspider.net/ie/assist.phpO2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [OWS Setup CmdLine] 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\40\bin\cfgwiz.exe' /r /pkg  'Office 2000 Server Extensions' /qO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUpO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [Zone Labs Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe'O4 - HKLM\..\Run: [Winsock32driver] ZoneLockup.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dllO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://F:\content\include\XPPatchInstaller.CABO16 - DPF: {3E13AA37-352F-4E5F-91C4-08A0BA0C9541} (InSPECS2_0 Control) - http://161.58.155.13/cab_files/InSPECS2_0.cabO16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exeO16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exeO16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) - http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cabO16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cabO16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cabO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dllO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cabO18 - Protocol: msero - {B0D92A71-886B-453B-A649-1B91F93801E7} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\msero.dll   Message Edited by ceri sheeran on 07-30-2004 07:09 PM Message Edited by ceri sheeran on 07-30-2004 07:15 PM Message Edited by ceri sheeran on 07-30-2004 07:24 PM

redwolfe_98 · Answer

i think that disabling spybot's resident scanners will help, and i would consider not using spywareguard..

when you run a scan with "hijackthis", you should have all other programs closed, or else they will, or could, show up in the "hijackthis" report..

http://aumha.org/a/hjttutor.htm

i would also run "error checking" for the harddrive.. (do it)

with the stuff that you are running, i did not expect to see any nasty stuff..

i would use spybot/tools and look in "system startup" to see if there is anything listed there that you do not need to be starting up at bootup..

alternatively, you could also use regedit to check what is running at startup:

"hkey_local machine/software/microsoft/windows/current version/run"

"hkey_current user/software/microsoft/windows/current version/run"

i would also look in start/all programs/"startup" and see if anything is starting from there, and, if you want, you can delete if from there, but use your own judgement about deleting something from there.. there could be something there that you do not want to delete.. for example, i have seem zone alarm put something in there before, something that was needed for starting up zone alarm, though that does not mean that your current version of zone alarm puts anything in there..

Message Edited by redwolfe_98 on 07-30-2004 09:40 PM

Texruss · Answer

Here's your problem:

O4 - HKLM\..\Run: [Winsock32driver] ZoneLockup.exe

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.hacarmy.d.html

Hit Control-Shift-Escape keys at same time. Click on Processes tab and End Task for the following entries:

ZoneLockup.exe

Run Hijackthis, scan and check the box left of these numbered line items:

O4 - HKLM\..\Run: [Winsock32driver] ZoneLockup.exe

O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://F:\content\include\XPPatchInstaller.CAB

O16 - DPF: {3E13AA37-352F-4E5F-91C4-08A0BA0C9541} (InSPECS2_0 Control) - http://161.58.155.13/cab_files/InSPECS2_0.cab

O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

With no other windows open click on fix checked button in Hijackthis.

Exit Hijackthis.

Reboot to SAFE MODE

Show HIDDEN FILES and folders

These necessary options are explained in FAQ's 8 and 9 on this page:

http://www.russelltexas.com/malware/faqhijackthis.htm

Hit Control-Shift-Escape keys at same time. Click on Processes tab and End Task for the following entries:

ZoneLockup.exe

Open Windows Explorer: type the word explorer at Start/Run box and click OK:
(Note...if the Run button is absent, right button click on the Start button and left button click on the word explore.

Navigate down the folder structure in left hand window and then in the right window delete the following file:

C:\Windows\System32\ZoneLockup.exe

Exit Explorer and empty the Recycle Bin.

Reboot in normal mode Windows and run Disk Cleanup: type cleanmgr at Start/Run. Scan all hard drives and check all categories at the end and click OK.

If you have any problems with Disk Cleanup completing...XP users can fix it here:

http://www2.whidbey.net/djdenham/DeleteOldFiles.htm

Next...download and run these two programs (Spybot S&D and Adaware) at the link below. Use Spybot first.

Most of the Internet baddies can be killed by a one-two punch with Spybot and Adaware assuming these three factors are achieved:

1. Latest version
2. Configured correctly for running options
3. New definitions from update feature

Chris has posted an excellent tutorial by dgosling on how to run Spybot S&D and also how to enable customized deep scanning functions for Adaware. Once you set these options they will be retained for future scans by Adaware.

Follow the directions in this detailed guide for Spybot and Adaware...print out the directions in the custom scan tutorial as a reference while you set these options for the custom setup of Adaware. These custom settings will be retained for future custom scans so don't go nuts thinking you have to do this every time you run it! It may take you five minutes to set them up, but it's worth it.

http://www.cjwd.demon.co.uk/spybot-adaware.html

Please note the free Spybot 1.3 does have a slight bug...it detects some DSO exploits falsely. Hopefully an upgrade will fix this.The problem is not serious and should not deter people from using Spybot.Also note recent live updates may fail with a "bad checksum" error message unless you change the download server location.

See how to solve this live update issue for Spybot at:

http://russelltexas.com/malware/allclear.htm

Reboot and browse a bit, exit IE 6 and post a new Hijackthis log.

Special Comments: After the final all clear is given by us you should flush your Restore Points for XP. That means disabling the Restore Point, rebooting to flush it, then re-enabling a new Restore Point. The reason why we need to do this is to purge the bad files hidden in System Restore which can't be cleaned by your antivirus programs.

See FAQ 12 here: http://www.russelltexas.com/malware/faqhijackthis.htm

Texruss
www.russelltexas.com
Classroom Teacher Tom Coyote Forum
Expert Malware Responder DellForum
Spyware Fighter Wilders Forum

Please be aware only the following DellForum members were trained at TomCoyote.com and SpywareInfo.com to help with malware like viruses, worms, adware, scumware, foistware and crudware in general. They are also the only experts specifically trained to analyze and advise on Hijackthis logs: Texruss, Baskar1234, Grinler, ChrisRLG, pskelley, cghost, SpotCheckBilly, and JohnK324.

Also...these longtime DellForum regulars have proven to me time and again their advice is excellent for malware questions in general, Windows operations, and many specific items in Hijackthis logs: jimw, ddeerrff, msgale, volcano11 and redwolfe_98. Please follow their advice when they respond to your problems. They have a proven track record here.

BTW...clicking on people's usernames at the left will reveal information about them if they chose to have an open profile. My credentials are available for your perusal.

Virus & Spyware

Hi jack this lock posted as requested

Was this post helpful?