Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC maker's logo. Keep tapping until it tells you it is going to Safe Mode or you see the Safe Mode menu. Select the top option.
Run HijackThis and just do a Scan only. Check then Fix Checked the following: O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
Run killbox. Where it says Full Path of File to Delete you need to type or copy (Hightlight and Ctrl + c)
and Paste (move to the killbox and place the cursor in the box and Ctrl + V):
C:\Program Files\SurfAccuracy
Then check the Delete on Reboot box and DELTREE box then the red button.
Agree you want to remove the file and let it reboot.
Logfile of HijackThis v1.99.1 Scan saved at 12:58:00 PM, on 11/8/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
If you are still getting popups then this is the stealth version of winfixer. I've seen it twice but both times it seemed to go away before we could get a copy of the file. Microsoft is looking for it to see how it works.
"Silent Runners.vbs", revision 41, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry: ---------------------------------
---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 77 seconds, including 18 seconds for message boxes)
i have run the rootkitrevealer and the results were:
1,213 discrepancies, the majority of which are cache files hidden from Windows API.
however, these two items were visible in Windows API but not in MFT or directory index:
C:\Documents and Settings\tdroesch\Local Settings\Temp\CPtf\{48F9A0EF-2A7C-45E1-A1EE-44FDD8272844}.html 11/8/2005 6:21 PM 10.15 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\AXOFMT6L\post[1].reply_to_id=20170 11/8/2005 6:21 PM 20.10 KB Visible in Windows API, but not in MFT or directory index.
and this one was a data mismatch:
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 11/8/2005 6:20 PM 80 bytes Data mismatch between Windows API and raw hive data.
This is a very strange result. The HJT log is clean but but the Silent Runners log shows there are several programs that should have shown up in the HJT log and in the processes list but don't. Print this out and very carefully follow the rest of the instructions. We are editting the registry. A mistake here could kill your PC and require a reload of Windows. If this makes you too nervous, say so. We can also use regseeker to find and remove these but this is faster.
(find the HKLM line and click on the plus sign in front of it to see the sub folders then find SOFTWARE under it and click on its plus sign then find Microsoft etc. When you get to Run, highlight it and look in the right pane for each of the following entries. You will not see the = sign. Just the text on the left in the Name column and the text on the right in the data column. You need to rightclick on each the Name entry and then select Delete, OK)
Right click on Start and select Explore. Then in the new window find the Views icon (bottom right of the two toolbars at the top. Looks like a little window with a down arrow. Press it and select Details. Then select Tools, Folder Options, check Use Windows Classic Folders, Apply then View, check Show Hidden Files and Folders, and uncheck the two that start with Hide. (ignore the warning) then say Apply. Then press Like Current Folder. OK.
Now locate the C:\Program Files folder (My Computer=> Local Disk C: => Program Files and click once on it. In the right pane will be an alphabetical list of folders and files. Scroll down in the right pane until you find SideFind folder. Right click on it and select Delete. If it won't delete then open the folder by clicking on it and then delete each file individually. If a file won't delete then right click on it and select Properties and uncheck the Read Only box then OK and try again.)
Under Program Files you should also find:
ISTbar folder which we also want to delete.
Also delete folders:
ISTsvc
Internet Optimizer
Power Scan
Now find the \WINDOWS folders in the left pane and click on it. In the right pane find and right click on
llpanh.exe
select Rename and rename it to llpanh.bad.
You may want to undo your changes at the beginning or at least check Hide Hidden and System Files before you close Explorer or you will see strange files on your desktop. Now reboot and see if things have improved. Run the silent runners program again and post a new silent runners log.
Could you also post a few of the cache entries from the rootkit revealer? I'm not sure exactly where these are located.
The wingeneric.dll entry clinches it. It's an aurora rootkit. Luckily there is a fix which was sent to me recently by Mike Burgess.
Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe
Save it to your desktop but do NOT run it yet.
Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the
Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.
Once in Safe Mode, please double-click aproposfix.exe and unzip it to the
desktop. Open the aproposfix folder on your desktop and run RunThis.bat.
Follow the prompts.
When the tool is finished, please reboot back into normal mode, and post a
the entire contents of the log.txt file in the aproposfix folder.
(Aproposfix log.txt)
Also run rootkitrevealer after you reboot and see if things have improved.
Removing hidden folder: Deletion of folder Winffice succeeded!
Deleting files:
Deletion of file C:\WINDOWS\system32\drivers\ntmnpfs.sys succeeded! Deletion of file C:\WINDOWS\system32\qmgdll32.exe succeeded! Deletion of file C:\WINDOWS\system32\qedprmsg.dll succeeded! Deletion of file C:\WINDOWS\system32\crelpr.exe succeeded!
and here are the results of the new rootkitrevealer scan:
C:\Documents and Settings\tdroesch\Cookies\tdroesch@trade-in-value[1].txt 11/9/2005 2:03 PM 610 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\0LA7GPY3\hdr_slice[1].gif 11/9/2005 2:03 PM 811 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\0LA7GPY3\hdr_tradein_vehicle[1].gif 11/9/2005 2:03 PM 2.26 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\85U7CLMF\hdr_replacement_vehicle[1].gif 11/9/2005 2:03 PM 2.71 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\85U7CLMF\submit_arrow[1].gif 11/9/2005 2:03 PM 1.24 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\85U7CLMF\xtrk-omniture-p-ctl-js[1].htm 11/9/2005 2:03 PM 15.90 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\AXOFMT6L\CAN6WRRP.htm 11/9/2005 2:03 PM 64.42 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\CFLNUEZ1\get_a_quote[1].gif 11/9/2005 2:03 PM 748 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\CFLNUEZ1\top_mid[1].gif 11/9/2005 2:03 PM 6.88 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\CFLNUEZ1\top_right[1].gif 11/9/2005 2:03 PM 11.31 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\F60JFX45\newcar[1].htm 11/9/2005 2:03 PM 801 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\SXQNK5AN\logo[1].gif 11/9/2005 2:03 PM 1.45 KB Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\WHGV0Z8J\1-pix-spacer[1].gif 11/9/2005 2:03 PM 49 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\XBNNXPSQ\how_it_works[1].gif 11/9/2005 2:03 PM 695 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\XBNNXPSQ\testimonials[1].gif 11/9/2005 2:03 PM 663 bytes Hidden from Windows API. C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\XBNNXPSQ\top_left[1].gif 11/9/2005 2:03 PM 12.19 KB Hidden from Windows API. C:\Program Files\Common Files\Symantec Shared\VirusDefs\20051109.009\vscanmsx.dat 11/9/2005 2:13 PM 2.02 KB Hidden from Windows API.
unfortunately, i am still getting pop-ups and have noticed that there is a new search sidebar that opens up when i open internet explorer. it is :sideFind by IST. also, on start up, a new program appears called Powerscan. this is quite the bummer.
Unpack to your desktop and run it. If you have green print at the top then just press Restore Original Hosts then OK.
IF you have red print then press make Hosts Writeable first.
Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.
Run HijackThis and just do a Scan only. Check then Fix Checked the following:
Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.
Run killbox. Where it says Full Path of File to Delete you need to type or copy (Hightlight and Ctrl + c)
and Paste (move to the killbox and place the cursor in the box and Ctrl + V):
C:\Program Files\SideFind
Then check the Delete on Reboot box and DELTREE box then the red button.
Agree you want to remove the file but do not let it reboot yet.
I have run CCleaner and this is the new HiJackThis logfile:
Logfile of HijackThis v1.99.1 Scan saved at 2:59:01 PM, on 11/9/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Here is the rootkitrevealer after running ccleaner and before proceeding with the instructions in your last reply:
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 11/9/2005 3:32 PM 80 bytes Data mismatch between Windows API and raw hive data. C:\Documents and Settings\tdroesch\Cookies\tdroesch@f1.racing-live[2].txt 11/9/2005 3:27 PM 71 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\tdroesch\Cookies\tdroesch@moto.racing-live[1].txt 11/9/2005 3:28 PM 75 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\tdroesch\Cookies\tdroesch@rally.racing-live[1].txt 11/9/2005 3:28 PM 76 bytes Visible in Windows API, but not in MFT or directory index. C:\WINDOWS\system32\spool\PRINTERS\FP00000.SHD 11/9/2005 3:34 PM 2.74 KB Visible in Windows API, but not in MFT or directory index. C:\WINDOWS\system32\spool\PRINTERS\FP00000.SPL 11/9/2005 3:34 PM 320.00 KB Visible in Windows API, but not in MFT or directory index.
During the running of HijackThis, the following item on the list of items to be checked and fixchecked was not visible:
I was setting up a blog to add to our website links a week or so ago and I downloaded this "Hello" program, per the recommendations of the Blogger website to assist with adding content to the blog. This may very well be where all of the problems began.
Here is the HijackThis log after all items were completed:
Logfile of HijackThis v1.99.1
Scan saved at 5:04:17 PM, on 11/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
RKinner
2 Intern
•
5.9K Posts
0
November 8th, 2005 00:00
Download the killbox:
http://www.bleepingcomputer.com/files/killbox.php
Unzip it to your desktop
Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.
Run HijackThis and just do a Scan only. Check then Fix Checked the following:
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
and Paste (move to the killbox and place the cursor in the box and Ctrl + V):
Then check the Delete on Reboot box and DELTREE box then the red button.
Agree you want to remove the file and let it reboot.
tdroesch
27 Posts
0
November 8th, 2005 13:00
thanks ron....
however, the problem still persists!!!
any ideas on how i can stop this?
thank you,
tom
RKinner
2 Intern
•
5.9K Posts
0
November 8th, 2005 18:00
Let's see the latest Hijackthis log.
Ron
tdroesch
27 Posts
0
November 8th, 2005 18:00
Hi Ron,
Here is the new log......
Thanks!
Logfile of HijackThis v1.99.1
Scan saved at 12:58:00 PM, on 11/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Documents and Settings\tdroesch\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tomdroesch.com/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.photojo.com/download/saxfile.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} - http://www.tbcode.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
RKinner
2 Intern
•
5.9K Posts
0
November 8th, 2005 19:00
If you are still getting popups then this is the stealth version of winfixer. I've seen it twice but both times it seemed to go away before we could get a copy of the file. Microsoft is looking for it to see how it works.
Get silent runners.vbs and run it per:
http://www.silentrunners.org/sr_scriptuse.html
Post the log from silent runners as a reply (it tends to be a bit large for the forum so you may need to break it up into two replies).
Also get rootkitrevealer from
http://www.sysinternals.com/Utilities/RootkitRevealer.html
and run it and tell me what it finds.
Ron
tdroesch
27 Posts
0
November 9th, 2005 00:00
Thanks again Ron.
Here is the silentrunners script:
"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Yahoo! Pager" = ""C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet" ["Yahoo! Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"BCMSMMSG" = "BCMSMMSG.exe" ["Broadcom Corporation"]
"IgfxTray" = "C:\WINDOWS\system32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\system32\hkcmd.exe" ["Intel Corporation"]
"AdaptecDirectCD" = "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" ["Roxio"]
"GhostStartTrayApp" = "C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe" ["Symantec Corporation"]
"ViewMgr" = "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" ["Viewpoint Corporation"]
"LVCOMS" = "C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" ["Logitech Inc."]
"LogitechGalleryRepair" = "C:\Program Files\Logitech\ImageStudio\ISStart.exe" ["Logitech Inc."]
"LogitechImageStudioTray" = "C:\Program Files\Logitech\ImageStudio\LogiTray.exe" ["Logitech Inc."]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"PicasaNet" = ""C:\Program Files\Hello\Hello.exe" -b" [file not found]
"IST Service" = "C:\Program Files\ISTsvc\istsvc.exe" [null data]
"STeoCi5SO" = "C:\WINDOWS\llpanh.exe" [null data]
"Internet Optimizer" = ""C:\Program Files\Internet Optimizer\optimize.exe"" [null data]
"Power Scan" = ""C:\Program Files\Power Scan\powerscan.exe" /aid:135343" [empty string]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{00000010-6F7D-442C-93E3-4A4827C2E4C8}\(Default) = "BHObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\nem220.dll" [empty string]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\(Default) = "UberButton Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Common\yiesrvc.dll" ["Yahoo!"]
{65D886A2-7CA7-479B-BB95-14D1EFB7946A}\(Default) = "YahooTaggedBM Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Common\YIeTagBm.dll" ["Yahoo! Inc."]
{A3FDD654-A057-4971-9844-4ED8E67DBBB8}\(Default) = "BAHelper Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SideFind\sfbho.dll" [empty string]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.dll" ["Roxio"]
"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Symantec\Norton Ghost 2003\GhoShExt.dll" ["Symantec Corporation"]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{B446400D-0030-457b-8F64-422A19605186}" = "Logitech Gallery"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Logitech\ImageStudio\NameSpc.dll" ["Logitech Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]
HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\tdroesch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssstars.scr" [MS]
Startup items in "tdroesch" & "All Users" startup folders:
----------------------------------------------------------
C:\Documents and Settings\tdroesch\Start Menu\Programs\Startup
"HotSync Manager" -> shortcut to: "C:\Program Files\Palm\HOTSYNC.EXE" ["Palm, Inc."]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Desktop Manager" -> shortcut to: "C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe" ["Research In Motion Limited"]
"Logitech Desktop Messenger" -> shortcut to: "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start" ["Logitech"]
Enabled Scheduled Tasks:
------------------------
"Norton AntiVirus - Scan my computer - tdroesch" -> launches: "C:\PROGRA~1\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
"{FAA356E4-D317-42A6-AB41-A3021C6E7D52}" = "ISTbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ISTbar\istbarcm.dll" [null data]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
"{FAA356E4-D317-42A6-AB41-A3021C6E7D52}" = "ISTbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ISTbar\istbarcm.dll" [null data]
Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ = "&Yahoo! Messenger" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesus.dll" ["Yahoo! Inc."]
{8CBA1B49-8144-4721-A7B1-64C578C9EED7}\ = "SideFind" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SideFind\sidefind.dll" ["IST"]
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ = "&Yahoo! Messenger" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesus.dll" ["Yahoo! Inc."]
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Shdocvw.dll" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]
{10E42047-DEB9-4535-A118-B3F6EC39B807}\
"ButtonText" = "SideFind"
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\
"ButtonText" = "Yahoo! Services"
"CLSIDExtension" = "{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Common\yiesrvc.dll" ["Yahoo!"]
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"
{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AIM"
"Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."]
{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
GhostStartService, GhostStartService, "C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE" ["Symantec Corporation"]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Norton AntiVirus Auto-Protect Service, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
Norton AntiVirus Firewall Monitor Service, NPFMntor, ""C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"" ["Symantec Corporation"]
Symantec Core LC, Symantec Core LC, ""C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
Symantec SPBBCSvc, SPBBCSvc, ""C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
HPZLNT09\Driver = "hpzlnt09.dll" ["HP"]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
PDF-XChange\Driver = "pxc25pm.dll" ["Tracker Software"]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 77 seconds, including 18 seconds for message boxes)
tdroesch
27 Posts
0
November 9th, 2005 01:00
does this help at all?
tdroesch
27 Posts
0
November 9th, 2005 02:00
C:\Program Files\Winffice\Cache\00002ba5_4371182b_000ca2dd 11/8/2005 1:36 PM 284 bytes Hidden from Windows API.
C:\Program Files\Winffice\Cache\00002bb8_43712c73_000d59f8 11/8/2005 2:53 PM 901 bytes Hidden from Windows API.
C:\Program Files\Winffice\Cache\00007de2_43714e0c_0007270e 11/8/2005 5:17 PM 6.27 KB Hidden from Windows API.
C:\Program Files\Winffice\Cache\00007e01_43714e3a_000487ab 11/8/2005 5:17 PM 5.34 KB Hidden from Windows API.
C:\Program Files\Winffice\ciosm168.exe 11/6/2005 8:47 PM 160.00 KB Hidden from Windows API.
C:\Program Files\Winffice\cmdngine.exe 11/8/2005 7:37 AM 912.00 KB Hidden from Windows API.
C:\Program Files\Winffice\data.bin 11/6/2005 8:47 PM 114.14 KB Hidden from Windows API.
C:\Program Files\Winffice\WinGenerics.dll 11/6/2005 8:47 PM 576.00 KB Hidden from Windows API.
C:\WINDOWS\system32\drivers\ntmnpfs.sys 11/6/2005 8:47 PM 12.00 KB Hidden from Windows API.
C:\WINDOWS\system32\qmgdll32.exe 11/6/2005 8:47 PM 460.00 KB Hidden from Windows API.
RKinner
2 Intern
•
5.9K Posts
0
November 9th, 2005 02:00
This is a very strange result. The HJT log is clean but but the Silent Runners log shows there are several programs that should have shown up in the HJT log and in the processes list but don't. Print this out and very carefully follow the rest of the instructions. We are editting the registry. A mistake here could kill your PC and require a reload of Windows. If this makes you too nervous, say so. We can also use regseeker to find and remove these but this is faster.
Boot into Safe Mode without networking.
Start, Run, regedit, OK
to bring up the registry editor. Navigate to:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
(find the HKLM line and click on the plus sign in front of it to see the sub folders then find SOFTWARE under it and click on its plus sign then find Microsoft etc. When you get to Run, highlight it and look in the right pane for each of the following entries. You will not see the = sign. Just the text on the left in the Name column and the text on the right in the data column. You need to rightclick on each the Name entry and then select Delete, OK)
"IST Service" = "C:\Program Files\ISTsvc\istsvc.exe" [null data]
"STeoCi5SO" = "C:\WINDOWS\llpanh.exe" [null data]
"Internet Optimizer" = ""C:\Program Files\Internet Optimizer\optimize.exe"" [null data]
"Power Scan" = ""C:\Program Files\Power Scan\powerscan.exe" /aid:135343" [empty string]
The above should all have shown up as O4 HKLM entries.
Now navigate to:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
Under Browser Helper Objects you will find subfolders with names:
{00000010-6F7D-442C-93E3-4A4827C2E4C8}
{A3FDD654-A057-4971-9844-4ED8E67DBBB8}
{FAA356E4-D317-42A6-AB41-A3021C6E7D52}
rightclick on each and select Delete, OK.
Now go to:
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
and find and delete subfolder:
{8CBA1B49-8144-4721-A7B1-64C578C9EED7}
Now go to:
HKCU\Software\Microsoft\Internet Explorer\Extensions
find and delete subfolder
{10E42047-DEB9-4535-A118-B3F6EC39B807}
Close regedit.
Right click on Start and select Explore. Then in the new window find the Views icon (bottom right of the two toolbars at the top. Looks like a little window with a down arrow. Press it and select Details. Then select Tools, Folder Options, check Use Windows Classic Folders, Apply then View, check Show Hidden Files and Folders, and uncheck the two that start with Hide. (ignore the warning) then say Apply. Then press Like Current Folder. OK.
Now locate the C:\Program Files folder (My Computer=> Local Disk C: => Program Files and click once on it. In the right pane will be an alphabetical list of folders and files. Scroll down in the right pane until you find SideFind folder. Right click on it and select Delete. If it won't delete then open the folder by clicking on it and then delete each file individually. If a file won't delete then right click on it and select Properties and uncheck the Read Only box then OK and try again.)
Under Program Files you should also find:
ISTbar folder which we also want to delete.
Also delete folders:
ISTsvc
Internet Optimizer
Power Scan
Now find the \WINDOWS folders in the left pane and click on it. In the right pane find and right click on
llpanh.exe
select Rename and rename it to llpanh.bad.
You may want to undo your changes at the beginning or at least check Hide Hidden and System Files before you close Explorer or you will see strange files on your desktop. Now reboot and see if things have improved. Run the silent runners program again and post a new silent runners log.
Could you also post a few of the cache entries from the rootkit revealer? I'm not sure exactly where these are located.
Ron
RKinner
2 Intern
•
5.9K Posts
0
November 9th, 2005 14:00
http://swandog46.geekstogo.com/aproposfix.exe
Save it to your desktop but do NOT run it yet.
Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the
Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.
Once in Safe Mode, please double-click aproposfix.exe and unzip it to the
desktop. Open the aproposfix folder on your desktop and run RunThis.bat.
Follow the prompts.
When the tool is finished, please reboot back into normal mode, and post a
the entire contents of the log.txt file in the aproposfix folder.
(Aproposfix log.txt)
tdroesch
27 Posts
0
November 9th, 2005 20:00
Hi Ron,
here is the log.txt file from AproposFix:
Log of AproposFix v1
************
Running from directory:
C:\Documents and Settings\tdroesch\Desktop\aproposfix
************
Registry entries found:
[HKEY_LOCAL_MACHINE\Software\CzXS5ACnYjF5]
@="t6LHGJLSTTSTTUTCotoDP38STTSiVT.otju.yTKQKL6EZYT5JAN6JKTFLEFH7KUKQK"
"Device"="\\\\.\\kINIlxbg"
"DriverPath"="C:\\WINDOWS\\system32\\drivers\\ntmnpfs.sys"
"DriverName"="Netport"
"HideUninstallerName"="C:\\Program Files\\Winffice\\ciosm168.exe"
"UninstallerPath"="C:\\WINDOWS\\system32\\crelpr.exe"
"UninstallerRegKey"="HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{30DB5FD4-73EF-4318-868F-74AB04C9AEEA}"
"UninstallerParams"="/CTUN"
"HDll"="C:\\WINDOWS\\system32\\qedprmsg.dll"
"ServerAddress"="adchannel.contextplus.net"
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
"PartnerId"="CP.IST2"
"InstallationId"="{Xb7eb714-53a8-35fe-be7c-41d7cd621bcf}"
"PageFiltering"=dword:00000001
"ClientName"="C:\\Program Files\\Winffice\\cmdngine.exe"
************
Removing hidden service:
Service Netport removed.
Removing hidden folder:
Deletion of folder Winffice succeeded!
Deleting files:
Deletion of file C:\WINDOWS\system32\drivers\ntmnpfs.sys succeeded!
Deletion of file C:\WINDOWS\system32\qmgdll32.exe succeeded!
Deletion of file C:\WINDOWS\system32\qedprmsg.dll succeeded!
Deletion of file C:\WINDOWS\system32\crelpr.exe succeeded!
Backing up files:
Done!
Removing registry entries:
REGEDIT4
[-HKEY_CURRENT_USER\Software\CzXS5ACnYjF5]
[-HKEY_LOCAL_MACHINE\Software\CzXS5ACnYjF5]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{30DB5FD4-73EF-4318-868F-74AB04C9AEEA}]
Done!
Finished!
and here are the results of the new rootkitrevealer scan:
C:\Documents and Settings\tdroesch\Cookies\tdroesch@trade-in-value[1].txt 11/9/2005 2:03 PM 610 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\0LA7GPY3\hdr_slice[1].gif 11/9/2005 2:03 PM 811 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\0LA7GPY3\hdr_tradein_vehicle[1].gif 11/9/2005 2:03 PM 2.26 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\85U7CLMF\hdr_replacement_vehicle[1].gif 11/9/2005 2:03 PM 2.71 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\85U7CLMF\submit_arrow[1].gif 11/9/2005 2:03 PM 1.24 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\85U7CLMF\xtrk-omniture-p-ctl-js[1].htm 11/9/2005 2:03 PM 15.90 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\AXOFMT6L\CAN6WRRP.htm 11/9/2005 2:03 PM 64.42 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\CFLNUEZ1\get_a_quote[1].gif 11/9/2005 2:03 PM 748 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\CFLNUEZ1\top_mid[1].gif 11/9/2005 2:03 PM 6.88 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\CFLNUEZ1\top_right[1].gif 11/9/2005 2:03 PM 11.31 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\F60JFX45\newcar[1].htm 11/9/2005 2:03 PM 801 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\SXQNK5AN\logo[1].gif 11/9/2005 2:03 PM 1.45 KB Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\WHGV0Z8J\1-pix-spacer[1].gif 11/9/2005 2:03 PM 49 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\XBNNXPSQ\how_it_works[1].gif 11/9/2005 2:03 PM 695 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\XBNNXPSQ\testimonials[1].gif 11/9/2005 2:03 PM 663 bytes Hidden from Windows API.
C:\Documents and Settings\tdroesch\Local Settings\Temporary Internet Files\Content.IE5\XBNNXPSQ\top_left[1].gif 11/9/2005 2:03 PM 12.19 KB Hidden from Windows API.
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20051109.009\vscanmsx.dat 11/9/2005 2:13 PM 2.02 KB Hidden from Windows API.
unfortunately, i am still getting pop-ups and have noticed that there is a new search sidebar that opens up when i open internet explorer. it is :sideFind by IST. also, on start up, a new program appears called Powerscan. this is quite the bummer.
Thanks for all of your help,
Tom
RKinner
2 Intern
•
5.9K Posts
0
November 9th, 2005 20:00
The stuff that rootkit revealer is seeing now is just junk. Probably would go away with ccleaner.
Download and install ccleaner.exe from http://www.ccleaner.com.
Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.
Run a new HiajckThis scan and save log and post the log as a reply. With the rootkit gone we may be able to see stuff we could not see before.
Ron
RKinner
2 Intern
•
5.9K Posts
0
November 9th, 2005 21:00
http://www.funkytoad.com/
IF you have red print then press make Hosts Writeable first.
Get DelDomain.inf from:
http://www.mvps.org/winhelp2002/DelDomains.inf and then right click on it and Install.
Download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet.
Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [STeoCi5SO] C:\WINDOWS\llpanh.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.tbcode.com/ist/softwares/v4.0/0006_regular.cab
Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.
and Paste (move to the killbox and place the cursor in the box and Ctrl + V):
Agree you want to remove the file but do not let it reboot yet.
C:\Program Files\ISTsvc
C:\Program Files\Internet Optimizer
C:\Program Files\Power Scan
Run another HijackThis log and post it as a reply. Let's
see how we did.
tdroesch
27 Posts
0
November 9th, 2005 21:00
Hi Ron,
I have run CCleaner and this is the new HiJackThis logfile:
Logfile of HijackThis v1.99.1
Scan saved at 2:59:01 PM, on 11/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\llpanh.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\tdroesch\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tomdroesch.com/
R3 - Default URLSearchHook is missing
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [STeoCi5SO] C:\WINDOWS\llpanh.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.photojo.com/download/saxfile.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.tbcode.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
tdroesch
27 Posts
0
November 9th, 2005 23:00
Hi Ron,
I have completed everything.
Here is the rootkitrevealer after running ccleaner and before proceeding with the instructions in your last reply:
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 11/9/2005 3:32 PM 80 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\tdroesch\Cookies\tdroesch@f1.racing-live[2].txt 11/9/2005 3:27 PM 71 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\tdroesch\Cookies\tdroesch@moto.racing-live[1].txt 11/9/2005 3:28 PM 75 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\tdroesch\Cookies\tdroesch@rally.racing-live[1].txt 11/9/2005 3:28 PM 76 bytes Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\system32\spool\PRINTERS\FP00000.SHD 11/9/2005 3:34 PM 2.74 KB Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\system32\spool\PRINTERS\FP00000.SPL 11/9/2005 3:34 PM 320.00 KB Visible in Windows API, but not in MFT or directory index.
During the running of HijackThis, the following item on the list of items to be checked and fixchecked was not visible:
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
Also, I have a feeling that the following item perhaps should have been included in our list, do you agree?:
04 - HKLM\..\Run:[PicasaNet]"C:\Program Files\Hello\Hello.exe"-b
Scan saved at 5:04:17 PM, on 11/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\tdroesch\Desktop\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.photojo.com/download/saxfile.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe