Message Edited by Midnight Star on 02-01-2005 10:49 PM

Mike,

Thanks for the advice, it’s taken 4 hours to scan, carefully follow your instructions and report back so here goes with the results:

Results of Trend Micro Housecall scan:

Initial message reads ‘Clean unsuccessful’ TROJ_ISTBAR.GM.

Scan lists 74 files ‘non cleanable or cannot access’!

C:\Documents and Settings\Arran\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-41742b8a-307032df.zip*Gummy.class*

C:\Documents and Settings\Arran\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arch22776.jar-68c62f3c-167f3abb.zip*RunString.class*

C:\Documents and Settings\Arran\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arch22776.jar-68c62f3c-167f3abb.zip*Colors.class*

C:\Documents and Settings\Arran\Local settings\Temp\Patch221.exe

C:\Documents and Settings\Arran\Local settings\Temp\Rem54.exe

C:\Documents and Settings\Arran\Local settings\Temp\_update.dat

C:\Documents and Settings\Arran\3.dat

C:\Documents and Settings\Arran\4.dat

C:\Documents and Settings\Arran\6.dat

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-1466ed40-713f166b.class

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-56bf106c-605a363a.class

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3jar-5ef20017-2a5a5ce9.zip*Gummy.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3jar-f30ee60-21874800.zip*Gummy.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.jar-31224e69-20a79f5e.zip*Dummy.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.jar-36dfcd99-2104661d.zip*Dummy.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-79c87584-713d8a4e.zip*BlackBox.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-79c87584-713d8a4e.zip*VB.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-79c87584-713d8a4e.zip*Dummy.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-79c87584-713d8a4e.zip*Beyond.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv283.jar-35dl530c-3551aecb.zip*Dummy.class*

C:\Documents and Settings\Fraser\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv453.lfl6a0fa-55152ddf.zip*Dummy.class*

C:\Documents and Settings\Fraser\LocalSettings\Temp\itlWe.exe

C:\Documents and Settings\Fraser\LocalSettings\Temp\SEGCRL.exe

C:\Documents and Settings\Fraser\LocalSettings\Temp\_update.dat

C:\Documents and Settings\Jane\3.dat

C:\Documents and Settings\Jane\4.dat

C:\Documents and Settings\Jane\6.dat

C:\Documents and Settings\Jordan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-lac02c55-210de88b.class

C:\Documents and Settings\Jordan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-305f4c99-32d096.class

C:\Documents and Settings\Jordan\Local Settings\Temp\1RWcme.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\2atnoG.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\aqhEq3.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\cNsYub.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\liCroN.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\RwBwSN.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\TLw3Be.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\uEBOvb.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\vHshhK.exe

C:\Documents and Settings\Jordan\Local Settings\Temp\xbyb7c.exe

C:\Documents and Settings\Jordan\3.dat

C:\Documents and Settings\Jordan\4.dat

C:\Documents and Settings\Jordan\6.dat

C:\Documents and Settings\Taylor\3.dat

C:\Documents and Settings\Taylor\4.dat

C:\Documents and Settings\Taylor\6.dat

C:\ProgramFiles\WindowsMediaPlayer\wmplayer.exe.tmp

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP228\A0056063.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP229\A0056111.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP293\A0075874.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP293\A0075875.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP293\A0075886.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP293\A0075887.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP293\A0075907.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP293\A0075910.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP295\A0076902.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP295\A0076904.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP302\A0079038.dll

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP302\A0081135.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP303\A0081198.dll

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP304\A0081218.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP304\A0081225.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP304\A0081227.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP322\A0081643.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP322\A0081644.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP322\A0081675.dll

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP322\A0081934.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP325\A0083115.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP334\A0083960.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP344\A0083962.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP344\A0084065.exe

C:\SystemVolumeInformation\_restore{B37680B2-BAOA-4E5D-BF30-83E44C588624}\RP344\A0084067.exe

C:\WINDOWS\DownloadedProgramFiles\VM.exe

C:\WINDOWS\SYSTEM32\akrules.dll

C:\WINDOWS\Temp\akrules.dll

Downloaded and ran the Adware.Istbar removal tool FxIstbar.exe

Scanned OK then appeared to reach a loop where it scanned the same files over and over again C:\SystemVolumeInformation\_restore{B37680B2-B……….. so stopped scan

Ran HiJackThis and ‘Killed’ the following:

C:\WINDOWS\System32\mshelp32.exe
C:\Program Files\SED\SED.exe
C:\Documents and Settings\Fraser\Application Data\eetu.exe
C:\WINDOWS\System32\r?gsvr32.exe

Opened command prompt and unregistered the following:

regsvr32 /u javafix3.dll
regsvr32 /u nzjzcpiq.dll
regsvr32 /u ash.dll

Ran HiJackThis and found and fixed the following:

O2 - BHO: (no name) - {A708A39C-8DA7-4e36-B3B0-0A1FFAFD4B6D} - C:\WINDOWS\system32\javafix3.dll

O4 - HKLM\..\Run: [mshelp32] C:\WINDOWS\System32\mshelp32.exe
O4 - HKLM\..\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [bsbav] C:\WINDOWS\bsbav.exe
O4 - HKCU\..\Run: [msjava critical update] c:\windows\jjfixer.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Fraser\Application Data\eetu.exe
O4 - HKCU\..\Run: [Smm] C:\WINDOWS\System32\r?gsvr32.exe
O4 - Startup: WindowsUpdate82427[1].exe

Deleted - C:\Program Files\SED and C:\Program Files\AdStatus Service

However C:\Program Files\ISTsvc was in use and could not delete. Not present in ‘Safe Mode’!

Deleted - C:\WINDOWS\System32\mshelp32.exe and C:\WINDOWS\System32\nzjzcpiq.dll

Access denied to C:\WINDOWS\System32\ash.dll  but deleted in ‘Safe mode’

Others not found:
C:\Documents and Settings\Fraser\Application Data\eetu.exe
C:\WINDOWS\system32\javafix3.dll
C:\WINDOWS\bsbav.exe
C:\windows\jjfixer.exe
C:\WINDOWS\qpexcccd.exe
WindowsUpdate82427[1].exe

Ran HiJackThis log to follow as exceeded 2000 characters!

Thanks again for the help.

Fraser

Message Edited by FraserN on 02-02-2005 07:47 PM

Hi

Many thanks for your time trying to sort out my adware/spyware problem. 

Things got a bit out of control - my HijackThis logs were too big to post and I was getting more propbems each time I attempted to read your messages.  I cut my losses and have paid for someone to rebuild my PC from scratch, he cloned the hard drive and then moved all my data over to the newly installed 'clean' PC.  I feel rather frustrated at not being able to sort out the problems but I guess I had spent about 25hrs and the situation didn't seem to be getting any better! 

Thanks again for your time.

Keep up the good work!

Fraser

fraser