Wintools folder, Trojan?

Question

Anybody familiar with a folder that appears in the Program\Common Files directory called Wintools? Ad-Aware's Ad-Watch tells me it contains evil stuff and lists the offending files: wtoolsa.exe, wtoolss.exe, wsup.exe and a few others - all of which do appear in the Wintools folder. Ad-Watch can't seem to handle blocking them, however, so I tried to manually delete the files individually and also the entire folder - but I get the red message saying they can't be deleted because they're being used by some other application (I'm thinking somehow it's getting itself online even though I don't have IE open, but I do have a cable connection, so essentially at their mercy?)

Any ideas?

Deborah B · Answer

yes, that is considered malware. quoted from the original site of the real wintools:

"'WToolsA.exe', 'WToolsS.exe', 'WSup.exe', 'WinTools Easy Installer' and 'WinTools' for internet explorer v2 are not our products. We do not spread viruses and trojans! Please use any antivirus program to remove viruses from your computer."

Being that you are asking about it, I can assume you arent the one that installed it.

Go to add/remove programs and see if there is an entry for WinTools. If so, uninstall it. If not then do the following:
Go to start>Settings>Control Panel>Administrative Tools>Services Look for "WinTools for IE service" in the right pane. If you find it, right click on it. Stop it by pressing the stop button. Then disable it by clicking on the startup type drop down and selecting "Disable"

Then right click on the taskbar and open taskmanager.
Go to applications and/or processes and end task on the following (WToolsS.exe should already be stopped from the above step):
WToolsAexe
WToolsS.exe
WSup.exe

Go to control panel and remove Wintools

REBOOT

Deborah B · Answer

i'm unsure how Wintools is getting in, but i do know it's making it's rounds and making alot of headaches in the process.  glad i was able to help

eiseyboy · Answer

Deborah B

Thanks much. So far, that seems to do the job (it did appear in add/remove programs, and it was removed successfully) - but I still can't determine how it got installed in my system to begin with.

Texruss · Answer

Let me interject the opinion that many anti-malware fighters don't trust uninstall programs written by the same folks who put the stuff on your system in the first place. Sometimes they do other things as they are supposedly 'uninstalling' their product.

I'd suggest you post a Hijackthis log so we can see what is going on under the covers. The average person has nearly 30 pieces of unknown malware on their computer. *;-)

We need you to download and install an analysis and repair tool called Hijackthis.

Go here and download the file: http://tomcoyote.com/hjt

Please unzip Hijackthis.zip into a new folder you create in the root (first) level of the C: drive. Name this folder HJT for best and safest results. (don't unzip it into a temp folder or run the file from a temp folder, or the Windows Desktop, etc...as it needs a safe folder to keep backup logs). Also when people post here and place it on the Desktop the log usually shows their full name since their Windows user profile is commonly named with their full name. We try not to disturb your privacy. *;-)

See this link for graphical instruction: http://russelltexas.com/spywareinfo/createhjtfolder.htm

See my entire Hijackthis FAQ (Frequently Asked Questions) at:

http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

After downloading, and unzipping the hijackthis file into a safe folder you create (preferably a folder named HJT in the first level of the C: drive)...run Hijackthis, click on the 'scan' button and then 'save log' button.

Copy and paste the contents of the text file you save into a reply to this message. A lot of posters make mistakes here in copying and pasting so reread the left info sidebar called Copy and Paste at http://www.tomcoyote.com/hjt

Special Notice! Hijackthis is a powerful tool that edits the brains of Windows (the Registry). DO NOT FIX anything in the Hijackthis log screen without assistance from the experts! Most of the line items in the scanned log are normal for Windows operation. Hijackthis should identify the vast majority of your problems and enable us to help you clean them off your system.

Stay in this thread for continuity. Reply to this message.

HTH (Hope that Helps)

Texruss

eiseyboy · Answer

Texruss,  As you suggested I downloaded Hijackthis and I have pasted the log here (from the notepad file) - however, it contained my full name (which I wasn't crazy about posting) in one line - the last of the C:\  list which was the Documents and Settings folder - so I simply deleted my last name. Hope that doesn't present a problem. The rest of the log is here in its entirety. Thanks for your help.   Logfile of HijackThis v1.97.7Scan saved at 11:32:19 AM, on 5/26/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Nhksrv.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeC:\WINDOWS\System32\GEARSEC.EXEC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\System32\CTHELPER.EXEC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\EPSON\Ink Monitor\InkMonitor.exeC:\WINDOWS\DELLMMKB.EXEC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\ezSP_Px.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exeC:\documents and settingsichard eisenstein\local settings	emp\UpQrnocZ.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Common Files\efax\HotTray.exeC:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exeC:\Program Files\Common Files\efax\Dllcmd32.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\WINDOWS\SYSTEM\MMAUSBCM.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exeC:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeC:\Palm\HOTSYNC.EXEC:\Program Files\SMASHER\Smasher.exeC:\Program Files\SMASHER\Smasher.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXEC:\Program Files\Netropa\OSD.exeC:\Program Files\SysAI\SysAI.exeC:\Program Files\Outlook Express\msimn.exeC:\Palm\Palm.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Richard\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R3 - URLSearchHook: IncrediFindBHO Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLLO2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL (file missing)O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\SysAI\AproposPlugin.dllO2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh309190.dllO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dllO2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLLO2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dllO4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXEO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [Jet Detection] 'C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe'O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exeO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exeO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exeO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe'O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe'O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe'O4 - HKLM\..\Run: [UpQrnocZ] C:\documents and settingsichard eisenstein\local settings	emp\UpQrnocZ.exeO4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\WkvZ.exeO4 - HKLM\..\Run: [AutoUpdater] 'C:\Program Files\AutoUpdate\AutoUpdate.exe'O4 - HKLM\..\Run: [Ad-watch] 'C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe'O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exeO4 - HKLM\..\Run: [072R3mW] mprptsvc.exeO4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exeO4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXEO4 - Startup: Camio Viewer 3.2.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeO4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Startup: SMASHER.lnk = C:\Program Files\SMASHER\Smasher.exeO4 - Global Startup: Adobe Gamma Loader.lnk = ?O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exeO4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXEO4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exeO4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exeO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: MMAUSBCM.LNK = C:\WINDOWS\SYSTEM\MMAUSBCM.exeO8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: Si&milar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.htmlO9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)O9 - Extra button: AIM (HKLM)O9 - Extra button: Real.com (HKLM)O9 - Extra button: MoneySide (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cabO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cabO16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cabO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabO16 - DPF: {2EC77245-C97C-4F5E-80D1-9B280C4CD820} - http://download.mailfrontier.com/matador/preview/instmtdr.cabO16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0378ac79e79420d1d617/netzip/RdxIE2.cabO16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cabO16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CABO16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37599.5949074074O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab

Texruss · Answer

You've got several fairly serious issues...a peper infection, Clearsearch, Incredifind, AproposMedia adware, and various Trojans.

Let's fix peper first...then we'll go from there:

http://www.russelltexas.com/spywareinfo/peper/pepercomments.htm

The line we are looking at is this one:

O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\WkvZ.exe
Don't fix it in Hijackthis...use the instructions at the link above.

The red bracketed box contains the CLISD (unique Class Identifier) which tells us that it's a peper file as the CLSID for peper always has 14 random characters with a number between 2 and 6 for the first character.

After you run the fix run a new HJT scan and see if any new 04 entries appear with that 14 character number sequence starting with a 2,3,4,5, or 6. If so it has morphed and you'll need to fix again.

Post a fresh log after the fix as we have more to do. Before you do so...it's very important you change your C: drive folder for hijackthis as we have many line entries to fix and a backup file is created for each one. It is not safe where you have it (privacy issues of your name notwithstanding...the temp folder flat out doesn't have any safety for backups.

Please create a new folder named HJT in the first level of the C: drive. Copy or move the hijackthis executable file into the HJT folder and delete all other zip copies and extracted copies elsewhere.

See FAQ's 2,3,4 at http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

All the best,

Texruss

eiseyboy · Answer

Texruss,

I downloaded the fix, and tried to run it, but the black command line box just popped up momentarily, then disappeared. I'm not sure how to proceed at this point. Any other options for removing the offending files?

Thanks

ChrisRLG · Answer

Recent evidence is that the 'official' peper removal tool no longer works. The tool the O^E was developing a few months ago is still effective however.

Canned fix:

You have a Peper infection, click here to download the PeperFix tool, save it to your desktop, doubleclick on it, click 'Find and Fix' and reboot if prompted.

Post a new hijackthis log after please. - DO NOT REBOOT UNTIL WE TELL YOU PLEASE - leave the computer running so that we can fix the peper line with hijackthis after you post the log.

Texruss · Answer

Post a new Hijackthis log and let's take a look. Thanks to Chris...I have updated my Peper page: Item 15 on this page:  http://www.russelltexas.com/spywareinfo/malware.htm All the best, Texruss

eiseyboy · Answer

ChrisRLG, I did as you suggested, but when I ran PeperFix it said 'no pepers found'. So whadya think? Thanks much, Eiseyboy

eiseyboy · Answer

OK, here's a brand new log from Hijackthis: Logfile of HijackThis v1.97.7Scan saved at 9:27:32 PM, on 5/27/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Nhksrv.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeC:\WINDOWS\System32\GEARSEC.EXEC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\CTHELPER.EXEC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\EPSON\Ink Monitor\InkMonitor.exeC:\WINDOWS\DELLMMKB.EXEC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\ezSP_Px.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exeC:\documents and settingsichard eisenstein\local settings	emp\UpQrnocZ.exeC:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Common Files\efax\HotTray.exeC:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exeC:\Program Files\Common Files\efax\Dllcmd32.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Netropa\OSD.exeC:\WINDOWS\SYSTEM\MMAUSBCM.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXEC:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeC:\Palm\HOTSYNC.EXEC:\Program Files\SMASHER\Smasher.exeC:\Program Files\SMASHER\Smasher.exeC:\Palm\Palm.exeC:\Program Files\Outlook Express\msimn.exeC:\Program Files\InterVideo\WCreator2\WCreator.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Richard\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R3 - Default URLSearchHook is missingO2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh309190.dllO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dllO2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar2.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar2.dllO4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXEO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [Jet Detection] 'C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe'O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exeO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exeO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe'O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe'O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe'O4 - HKLM\..\Run: [UpQrnocZ] C:\documents and settingsichard eisenstein\local settings	emp\UpQrnocZ.exeO4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Agm8.exeO4 - HKLM\..\Run: [AutoUpdater] 'C:\Program Files\AutoUpdate\AutoUpdate.exe'O4 - HKLM\..\Run: [Ad-watch] 'C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe'O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exeO4 - HKLM\..\Run: [072R3mW] mprptsvc.exeO4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exeO4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXEO4 - Startup: Camio Viewer 3.2.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeO4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Startup: SMASHER.lnk = C:\Program Files\SMASHER\Smasher.exeO4 - Global Startup: Adobe Gamma Loader.lnk = ?O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exeO4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXEO4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exeO4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exeO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: MMAUSBCM.LNK = C:\WINDOWS\SYSTEM\MMAUSBCM.exeO8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: Si&milar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.htmlO9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)O9 - Extra button: AIM (HKLM)O9 - Extra button: Real.com (HKLM)O9 - Extra button: MoneySide (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cabO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cabO16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cabO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabO16 - DPF: {2EC77245-C97C-4F5E-80D1-9B280C4CD820} - http://download.mailfrontier.com/matador/preview/instmtdr.cabO16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0378ac79e79420d1d617/netzip/RdxIE2.cabO16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cabO16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CABO16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37599.5949074074O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab

Texruss · Answer

Warning! Unsafe Hijackthis folder! Please create a new folder named HJT in the first level of the C: drive. Copy or move the hijackthis executable file into the HJT folder and delete all other zip copies and extracted copies elsewhere.

See FAQ's 2,3,4 at http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

Run Hijackthis from safe folder, scan and check the following line entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [UpQrnocZ] C:\documents and settings\username\local settings\temp\UpQrnocZ.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"

O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [072R3mW] mprptsvc.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
Comments: dead link
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0378ac79e79420d1d617/netzip/RdxIE2.cab
Comments: Netster
See FAQ's 2,3,4 at http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

With no other programs, other windows open or any browser running, click on fix checked button in Hijackthis.

Reboot to SAFE MODE and Show HIDDEN FILES and folders

FAQ 8 and 9 on this page: http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

Open Windows Explorer: type the word explorer at Start/Run box and click OK:

Drill on down and delete the following files, folders and/or folder contents:

C:\WINDOWS\System32\SearchBar.htm       file
C:\WINDOWS\System32\mprptsvc.exe         file
C:\WINDOWS\System32\IEHost.exe              file

C:\documents and settings\username\local settings\temp    folder contents only

C:\Program Files\AutoUpdate                         folder and all subcontents
C:\Program Files\Common files\WinTools      folder and all subcontents

Reboot in normal mode Windows and run Disk Cleaner: type cleanmgr at Start/Run. Scan all hard drives and check all categories at the end and click OK.

You should also try to get rid of Peper again. Chris gave me updated instructions for the now-recommended tool:

http://www.russelltexas.com/spywareinfo/peper/pepercomments.htm

After running the tool, reboot and run Hijackthis. Scan, check and fix this entry:

O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Agm8.exe

Reboot, browse a bit and then post a fresh log.

Texruss

After the final all clear is given by us you should flush your Restore Points for XP. That means disabling the Restore Point, rebooting to flush it, then re-enabling a new Restore Point. The reason why we need to do this is to purge the bad files hidden in System restore which can't be cleaned by your antivirus programs.

See FAQ 12 here: http://www.russelltexas.com/spywareinfo/faqhijackthis.htm

eiseyboy · Answer

Can't get to it for a couple of days, but will do by Monday and let you know then. Thanks much, Eiseyboy

eiseyboy · Answer

Texruss,

OK - I tried all the things you suggested. Some problems/variations: first, there were no files called SearchBar.htm, mprptsvc.exe or IEHost.exe in the System32 folder, nor were there AutoUpdate folders or WinTools folder (check earlier in this thread - I was instructed in removal of that WinTools stuff) - and, when I tried to empty the temp folder contents, there were a few files that couldn't be removed: I got the message "cannot delete 159293~1: cannot find specified file..." and for several others like that. I did manage to remove about 95% of the files in that folder however.

Disk Cleaner woudn't run - it locked up after a few seconds, so I Control/Alt/Delete and stopped it.

When I rebooted and tried Peperfix it said there were no pepers. I ran Hijackthis and did find the entry you named, so I checked it and fixed it, then rebooted.

I'm a tad concerned because my hard disk is making a bit of noise (a hum that wasn't there earlier) and thinks are moving somewhat slowly.

So what's the next move in your opinion?

Texruss · Answer

Rerun Hijackthis in SAFE MODE and delete any of those troublesome don't-want-to-go-away entries. Run Disk Cleaner in Safe Mode also...

Also see this.

Then reboot and run a fresh log for me.

Thanks,

Texruss

Message Edited by Texruss on 05-30-2004 10:27 PM

Virus & Spyware

Wintools folder, Trojan?

Was this post helpful?