Hijacked Explorer by about blank

Question

Please help if you can.   I have been I am running Windows XP and my wife and I share this Dell computer.   Both our IE sessions have been taken over by the ABOUT BLANK hijacker.   I've tried Ad Aware and Spybot and MS Antispyware and HijackThis, but have not been able to kill the little beast.   Can anyone help me if I give you the Scan info found by HijackThis??   Logfile of HijackThis v1.99.0 Scan saved at 12:22:55 AM, on 1/13/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\QUICKENW\QAGENT.EXE C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Iomega\AutoDisk\ADUserMon.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\mrtMngr.EXE C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\PROGRA~1\Iomega\System32\AppServices.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Iomega\AutoDisk\ADService.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\hmac3438\My Documents\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\pmac3438\LOCALS~1\Temp\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\pmac3438\LOCALS~1\Temp\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {20866804-7170-420C-89FC-3CDA78CB331C} - C:\WINDOWS\system32\ffhk.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [QAGENT] C:\Program Files\QUICKENW\QAGENT.EXE O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://www.nwm11.duke-energy.com/iNotes.cab O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned35.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab O21 - SSODL: Trayz - {F5B7D0BE-5f02-4211-96DB-386DFA244900} - (no file) O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee.com Personal Firewall Service - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: Intel(R) NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: Iomega Active Disk - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Midnight Star · Answer

oneeyedcat,

Let's take a pass with HiJackThis, then see what we have left...

Now, let's run HiJackThis, then:

1. click " Config..."
2. click " Misc Tools"
3. click " Delete a file on reboot"
4. browse to, then double-click on each of the file(s) below, one at a time, if present:

C:\DOCUME~1\pmac3438\LOCALS~1\Temp\sp.dll
C:\WINDOWS\system32\ffhk.dll

5. when prompted to " Reboot Now", after selecting each file, select " No"

Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

regsvr32 /u ffhk.dll

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to a command prompt to save on the typing.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\pmac3438\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\pmac3438\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;

O2 - BHO: (no name) - {20866804-7170-420C-89FC-3CDA78CB331C} - C:\WINDOWS\system32\ffhk.dll

O4 - Global Startup: Digital Line Detect.lnk = ?

O21 - SSODL: Trayz - {F5B7D0BE-5f02-4211-96DB-386DFA244900} - (no file)

Now, with all windows closed except HiJackThis, click " Fix checked".

Reboot your computer and post back a new log.

Mike.

Midnight Star · Answer

Hugh,

Ok, there may be a 'hidden' process running that we might need to address with another tool. But before we try that, it looks like when it 'waxed-out', it dropped behind two filters, let's remove those, reboot and see if that fixes the problem.

When you say 'didn't work', can you provide me with more symptoms of the problem? Does it cross over when you switch to your wife's user account? When we're done with yours, post up a log from her account and i'll see if anything is there was we need to remove; be sure to edit out any information from the log that you don't want posted on this board.

Now, let's run HiJackThis, then:

1. click " Config..."
2. click " Misc Tools"
3. click " Delete a file on reboot"
4. browse to, then double-click on each of the file(s) below, one at a time, if present:

C:\WINDOWS\system32\ffhk.dll

5. when prompted to " Reboot Now", after selecting each file, select " No"

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O18 - Filter: text/html - {6E1F6C2B-67FF-4424-A9DF-A46B331FCC98} - C:\WINDOWS\system32\ffhk.dll
O18 - Filter: text/plain - {6E1F6C2B-67FF-4424-A9DF-A46B331FCC98} - C:\WINDOWS\system32\ffhk.dll

Now, with all windows closed except HiJackThis, click " Fix checked".

Reboot your system and post back a new log.

Mike.

oneeyedcat · Answer

Mike! I'm slightly optimistic! It looks as if the hijacker about:blank is no longer taking over either of our IE sessions. At least it has not for awhile. Maybe I set up MS AntiSpyware correctly and it is simply 'blocking' things...or maybe it is gone!

I do need to answer your question and then ask you 3 questions:

Your questions: "When you say 'didn't work', can you provide me with more symptoms of the problem? Does it cross over when you switch to your wife's user account?" Yes, the problem seems to be on both accounts. Also, the reason(s) I thought the problem was still there was because:

1. I still got the same list of four SCAgent Trojans hits when I ran Adaware Away. I've cleaned them out, now and have not seen them for a while. Keeping my fingers crossed.

2. I still got hits when I ran Ad-Aware SE. However, the last time I ran it the spyware did not seem related to the original problem. The three (3) problems were defined as:

a. Vendor:Tracking Cookie, Category: Data Miner, Object Type:IECache

3. I still got hits when I ran SpyBot Search and Destroy. I got six items similar to this:

a. HKEY_USERS\S_1_5_19\Software\Microsoft\Windows\ Current Version\

Internet Setting\Zones\0\1004!=w=3

4. The "1 program running" message still appears beside the logon ID icons as I switch between my wife and my sessions....even tho there is not an obvious program running

My Question 1: When you say "it looks like when it 'waxed-out', it dropped behind two filters, let's remove those, reboot and see if that fixes the problem." Do you mean for me to do something other than follow the instructions you provided later in that note? I'm not familiar with "removing filters" so did not want you to think I was doing anthing other than following your later instructions.

My Question 2: I'm a novice at this, so I'm not sure what info that I might should edit out of my posting. Can you give me some pointers?

My Question 3: Any idea how to find out what programs are running and deal with them?

Midnight Star · Answer

Hugh,

That's good news! I'm not quite sure about the Spybot thing, but that registry entry looks 'user' related; i'm not a registry guru just yet so you might try just posting this and see if someone else might help you with it:

HKEY_USERS\S_1_5_19\Software\Microsoft\Windows\Current Version\ Internet Setting\Zones\0\1004!=w=3

-

No, just post a new log and let me take a final look - it should be completely gone. What's interesting with that particular 'infection' on that system, is the 018 entry(s) [ the filters I was referring to ] weren't evident in the first log, but appeared after we'd removed everything else. That's a new behavior for it.

If you decide to post the log for the other user account(s), you might want to edit any names out of log that you don't want displayed in an open forum - some posters might have a problem with revealing personal names in the logs.

Try "Process Explorer" from http://www.sysinternals.com/win9x/98utilities.shtml.

-

Mike.

oneeyedcat · Answer

Mike, I don't know what to say.    I tried unregistering ffhk.dll and deleting the filter references to it...but neither the dll nor the filters were there.    I'm trying to remember what all I did between the last time I followed your instructions and now.    I think that I used MS Antispyware advanced tools to either delete or quaranteen ffhk.   Does that make sense or could I be making up a false memory? Anyway here is the latest scan after first loggin on to my session and then my wifes then back to mine (leaving both of us logged on).   I 'xx'ed' out my ID but did not see her's anywhere in the scan.   Hugh   ps:   Thanks so much for what you've helped me through.   Maybe I won't have to format the hard drive after all.   Logfile of HijackThis v1.99.0 Scan saved at 4:35:24 PM, on 1/13/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\Program Files\QUICKENW\QAGENT.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Iomega\AutoDisk\ADUserMon.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\mrtMngr.EXE C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\PROGRA~1\Iomega\System32\AppServices.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\winlogon.exe C:\Documents and Settings\xxxxxxxx\My Documents\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/?u O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [QAGENT] C:\Program Files\QUICKENW\QAGENT.EXE O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee.com Personal Firewall Service - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: Intel(R) NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

Midnight Star · Answer

Hugh,

You've got me there; life was my first personal possesion and senility will be my last ... :smileyvery-happy:

-

Ok, that log looks good - great work!

Now let's do some cleanup for your user account...

1. Run " Disk Cleanup" and allow it to remove everything it finds.

2. Go to www.trendmicro.com and click " Free Online Scan", then " Scan now, it's free!". When it's

downloaded, select all available drives, then check(tick) " Auto clean", then click " Scan".

3. Run AdAware SE Personal and " perform a full system scan", then Spybot S&D, and "Check for Problems". Let them both remove the residual 'problems' left that HiJackThis couldn't fix.

4. Disable, then re-enable system restore; with a reboot in-between. Then immediately create a new system point manually.

Remember, i'll also need to see a log that was run from your wife's user account to make sure that nothing is running that shouldn't be.

-

Mike.

oneeyedcat · Answer

Ok, Mike.   Thanks for your patience and help.   I'm now sure that this event will NOT force me to format the hard-drive and re-install everything!  I ran the clean-up and then FREE ONLINE SCAN and ADAWARE SE PERSONAL but neither found any problems. I ran SPYBOT S&D and it found and deleted the same 6 items it seems to find each time I run it (although early-on it found other items, too).   The items are all categorized under DSO EXPLOIT and they begin with 'HKEY_USERS\....' (with Microsoft) somewhere in the long description.   On the right of each description is an icod with the 'Registry Change' label.    I disabled restore, rebooted, enabled restore, and took a manual check point. I then switched from my session and logged on to my wife's ID.   As I did I noticed the 1-program-running message beneath my logon icon.    I wonder if removing some of the spyware programs that I've recently installed my solve that?  The last guy from Dell Support that I spoke with said the only spyware program I'd probably need is the MS Antispyware program.   What do you think? After I logged on to Pat's ID I ran the HiJackThis scan and xxx'd out my ID:   Here it is: Hugh Logfile of HijackThis v1.99.0Scan saved at 12:29:55 PM, on 1/14/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\WINDOWS\system32\cisvc.exeC:\PROGRA~1\Iomega\System32\AppServices.exec:\PROGRA~1\mcafee.com\vso\mcvsrte.exeC:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeC:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exec:\PROGRA~1\mcafee.com\vso\mcshield.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\Program Files\QUICKENW\QAGENT.EXEC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\system32\mrtMngr.EXEC:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exeC:\Documents and Settings\xxxxxxxx\My Documents\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exeO4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe'O4 - HKLM\..\Run: [QAGENT] C:\Program Files\QUICKENW\QAGENT.EXEO4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exeO4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe'O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.htmlO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cabO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cabO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exeO23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exeO23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exeO23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exeO23 - Service: McAfee.com Personal Firewall Service - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeO23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEO23 - Service: Intel(R) NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exeO23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

Midnight Star · Answer

Hugh,   Your welcome!   You might give it a try - many of the spyware boards have reported success using it. Dell would recommend it since they have contracts with Microsoft in various areas ... :) - me, i'm impartial. But if you decide to use it, let me know what it finds?   There's going to be a building 'conflict' between the anti-spyware companies since Microsoft stepped into the game, and this move concerns me. To me, the best way to hammer back at the people who are trying to get them to improve their products (especially the windows operating system) are to completely replace it with something of their own; and this is going to cost even more jobs from all other rival companies down the road. That's not very good for economic growth.   Sorry, back to the software - It's based on the Giant anti-spy software (and Giant's a good company), but i've seen not less than a half-dozen system's that have spyware problems that appear to be using it, and other users are having a problem with it removing item(s) it shouldn't. I expect alot more from the talent that Microsoft has accrued over the years. To be honest, it recognized two 'problems' on my system that weren't really problems at all. If it's going to report a spyware threat as serious, it should at least differentiate between a real running process (the biggest threat), instead of an obscure reference just cluttering the system registry. If I didn't know any better, i'd be 'goaded' into purchasing that product when the free beta release expires just thinking that my system would be safer.   Also, The interface doesn't have a windows 'feel' (which is strange); not like the other operating system components, and if Microsoft was going to invest money, i'd rather see a locked down operating system, with a 1000 more jobs created, than expansion by 'buying out' technologies and causing conflicts across the board with other vendors.   AdAware and Spybot are by far not perfect, and I have no affiliation with either, but the reason I recommend them, is because they are free (same with AVG, and ZA). Alot of users, won't purchase what they need to protect themselves while online and this gives me the option to help them get something installed and make them aware of what they need to keep themselves and their families safer while using the internet; this basic understanding is better than all the spyware busting apps on the planet.     The DSO exploits are a bug in Spybot; if your upto date with Microsoft updates and you've already used Spybot to fix those entry(s), then your ok, just ignore it.   I think patching it would be fairly easy, but you'd need to understand where Spybot came from to understand. Alot has been asked of these programs over such a short period of time, and that expectation can be very hard to live upto. But my last vote - please patch it!     Your wife's log looks just fine, there's nothing there that I can see.  Try the Microsoft anti-spyware tool out and see what it comes up with, then just keep an eye on your system over the next few days.   Wow! I feel like I just wrote a short essay ... :smileyvery-happy:   -   Mike.

oneeyedcat · Answer

Great insight, Mike.    I'll have to think some more about which spyware pgm(s) to keep.  I'm signing off as a 'happy camper' thanks to you and your help.   Hugh

Midnight Star · Answer

Hugh, Your more than welcome. Mike.

Virus & Spyware

Hijacked Explorer by about blank

Was this post helpful?