Virus Help....possibly spyware?

Started by PhillyPhreak54, May 21, 2006, 02:22:27 AM

Previous topic - Next topic
Print
Go Down Pages 1 2 3 4 5 6
User actions

PhillyPhreak54

#45
June 10, 2006, 06:17:11 PM
QuoteScan saved at 6:17:13 PM, on 6/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gophersearch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: DPCUpdater Object - {E291663A-2D6F-4B56-B9DF-AE239AEF6A5B} - C:\WINDOWS\system32\jkhfc.dll
O2 - BHO: ohb - {E8888041-B24A-4B0B-911B-12B018E43F21} - C:\WINDOWS\system32\rlmtcs.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2871FC9B-5E34-4AAE-9E9C-EBD1652D5C92} (Rhapsody Player Engine) - http://forms.real.com/real/player/download.html?f=windows/mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146726124343
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: jkhfc - C:\WINDOWS\system32\jkhfc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

PhillyPhreak54

#46
June 10, 2006, 06:20:00 PM
Interesting.

That gophersearch shtein is back!!

I am also back in safe mode. When I tried it in normal mode I did not get a pop up, but it was running slow. And I tried to start Mozilla and it took forever. When it finally started I was about to post the HiJack log and it froze up in me. So I restarted in safe again.

I know that the gopher stuff was gone before. And I ran HiJack in safe and normal and they both show the gopher stuff being back.

It was running fast when that stuff was off of there. But now that it is back I am moving slow again. Except when I am in safe. In safe I am flying. But when I am in normal, it is slooooooooow

PhillyPhanInDC

#47
June 10, 2006, 06:20:59 PM
It's hard to say Phreak. There are thousands of different types. There is something on your machine that is causing it to run, that's for sure. When in save mode, delete your internet caches, history, cookies, etc. Go into your Temp folder and delete everything in there.  Remember to have "Hidden Files and Folders"  shown, and go into you Temporary Internet Files folder and others that are similar, and delete everything in there. Run all your scans and delete everything, including anything that is quarantined. Shoot another HijackThis log up when you get a chance. I know it is porn stuff, and you can't post some of it here, but I need names to know what is going on. Look for titles in the Window from companies, or on the Window header in Internet Explorer. If it is something you can't post because it says something like "Greatest studs on the net, Chuggie rates us number one!" Send it in a PM.
"The very existence of flamethrowers proves that some time, somewhere, someone said to themselves, "You know, I want to set those people over there on fire, but I'm just not close enough to get the job done.""  R.I.P George.

PhillyPhreak54

#48
June 10, 2006, 06:22:37 PM
And guess what?

I just got that goddamn SysProtect popup in safe mode now! That is the one that has been giving me trouble for awhile now that I thought I got rid of. That has to be the gopher thing. Has to be.

Here is the url for that popup:

the link

MURP

#49
June 10, 2006, 06:24:47 PM
why not just save your important files and wipe the entire drive clean.  install windows fresh again and reload your files.   could have done all of that by now. 

Geowhizzer

#50
June 10, 2006, 06:25:40 PM

PhillyPhanInDC

#51
June 10, 2006, 06:25:47 PM
Quote from: PhillyPhreak54 on June 10, 2006, 06:20:00 PM
Interesting.

That gophersearch shtein is back!!

I am also back in safe mode. When I tried it in normal mode I did not get a pop up, but it was running slow. And I tried to start Mozilla and it took forever. When it finally started I was about to post the HiJack log and it froze up in me. So I restarted in safe again.

I know that the gopher stuff was gone before. And I ran HiJack in safe and normal and they both show the gopher stuff being back.

It was running fast when that stuff was off of there. But now that it is back I am moving slow again. Except when I am in safe. In safe I am flying. But when I am in normal, it is slooooooooow

This isn't all bad, now we know exactly what is farging up your machine. Now to make sure it's completely gone....
"The very existence of flamethrowers proves that some time, somewhere, someone said to themselves, "You know, I want to set those people over there on fire, but I'm just not close enough to get the job done.""  R.I.P George.

PhillyPhreak54

#52
June 10, 2006, 06:30:55 PM
Ok, check this out...

I went into my control panel to make sure I was showing all hidden folders again.

I clicked on the Folder Options icon.

That comes up and it has three tabs to it...

General, View and File Types

Under the View tab is where I see the hidden thing. I am showing hidden files.

But when I clicked on the File Types tab I see a thing that says URL: Gopher Protocol and it has a picture of the internet explorer icon next to it.

IE logo (NONE) URL: Gopher Protocol

Thats was it looks like

PhillyPhanInDC

#53
June 10, 2006, 06:40:30 PM Last Edit: June 10, 2006, 06:42:34 PM by PhillyPhaninDC
Okay, go ahead and run the Hijackthis in safe mode again and check and fix these...

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gophersearch.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/

Then go to start > run> and type %temp% and hit enter. Delete every file there (have to be in safe mode).

Go to start > run > and type cleanmgr and hit enter. Select your C: Drive, then when it is done "Compressing" make sure "Downloaded Program Files", "Temporary Internet Files", "Offline Web Pages", "Recycle Bin", "Temporary Files" and "WebClient/Publisher Temporary Files" are checked and click okay. Hit yes to continue. Do all of your virus and other scans again, then reboot in normal mode and see what we get....
"The very existence of flamethrowers proves that some time, somewhere, someone said to themselves, "You know, I want to set those people over there on fire, but I'm just not close enough to get the job done.""  R.I.P George.

PhillyPhreak54

#54
June 10, 2006, 06:44:24 PM
Ok, I am about to start all of that now.

I owe you a case of beer, by the way. Thank you for your help.

PhillyPhanInDC

#55
June 10, 2006, 06:59:38 PM
You will also want to go to microsoft.com and download Windows Defender (ha!) and install it. It's free, and it does a decent job of nabbing Spyware and Adware....
"The very existence of flamethrowers proves that some time, somewhere, someone said to themselves, "You know, I want to set those people over there on fire, but I'm just not close enough to get the job done.""  R.I.P George.

PhillyPhreak54

#56
June 10, 2006, 07:06:09 PM
Ok, I am still in safe and just finishing up. But one thing I did find and hope I fixed...

When I ran adaware it came up with a possible hack attempt and it was in my favorites and settings for the computer. I looked at the link and it was some sex link shtein that was embedded in my documents and settings. So I then searched for the link that I was given and found it on the PC and deleted it.

I am about to restart in normal and see whats up.

MDS

#57
June 10, 2006, 07:23:01 PM
I have some of the same problems, Phreak. I'm going to Temple on monday night and a computer nerd is going to fix things. Even though I'm not enrolled this semester, I guess I'm still able to use computer services. Pays to live 25 minutes from campus.
Zero hour, Michael. It's the end of the line. I'm the firstborn. I'm sick of playing second fiddle. I'm always third in line for everything. I'm tired of finishing fourth. Being the fifth wheel. There are six things I'm mad about, and I'm taking over.

dis12

#58
June 10, 2006, 07:25:12 PM
Quote from: PhillyPhreak54 on June 10, 2006, 06:44:24 PM
Ok, I am about to start all of that now.

I owe you a case of beer, by the way. Thank you for your help.

damn,  after all that I think you owe him an entire  liquor store!

...good luck men, we're all counting on you!
C6 at the WAC

*** SPD ***

PhillyPhanInDC

#59
June 10, 2006, 07:28:24 PM
Quote from: dis12 on June 10, 2006, 07:25:12 PM

damn,  after all that I think you owe him an entire  liquor store!

...good luck men, we're all counting on you!

He hasn't seen the bill yet.

Phreak is actually a good customer. Most times at work I get, "Hey, my computer isn't working right." To which I respond, "What's wrong with it? What is it doing? What is it not doing?" And I'll normally get "Uh, I don't know, it just isn't working."
"The very existence of flamethrowers proves that some time, somewhere, someone said to themselves, "You know, I want to set those people over there on fire, but I'm just not close enough to get the job done.""  R.I.P George.
Print
Go Up Pages 1 2 3 4 5 6
User actions