|
Trojan horse Downloader.agent.BF
I have some how managed to download some sort of trojan. AVG reports regular that there is a problem, identified by Trojan horse Downloader.Agent.BF
also comes up with a file it is in eg C:\WINDOWS\system\msxr32.exe to many others to list over the 24 hours since it started. Several sweeps with the restore switched off, with updated AVG 6 and Ad-aware 6.0 and it still keeps poping up, I have even run AVG from the command prompt but the programme didn't kill it. Also my Internet explorer home page will not change from res://rcvki.dll/index.html no matter what I do. Also while doing searches with google.co.uk for clues another, american based search engine pops up with it's list of results. I have run Norton Antivirus Trojan finder from the web site and it found nothing. Currently running AVG 6 again, part way thru and reporting 34 and going up files, Downloader Agent. Help I feel a total cleansing of the hard drive coming on.... |
allthatglitters,
It sounds like the file has been executed. :( I would try scanning in Safe Mode, since that will give you a better chance of removing the pests from your computer. Take Care, Richard |
I have already tried with the computer in safe mode. But it still continues, looks like I'll just have to reformat the hard drive.
Done Deed, Just finishing of updates to XP and office, drivers. |
Hi allthatglitters,
Glad you're sorted out. res://rcvki.dll/index.html This is one of the latest variants of CoolWebSearch. Without more detail, I couldn't say for sure which one, but most use a super-hidden file with locked permissions, which makes it both difficult to find and to delete. If you have a look around the security forums, you will see many people in the same boat as you were. :ugh: Cheers Liam |
allthatglitters,
It is a little late now, but for the future. If your Hard Drive have a Virus that has executed its payload, you can do a fresh install of WinXP on top of itself. This will let you keep all the data on the drive and severs the link between the Virus and the OS. You just cannot access any infected files still on the Hard Drive until you run an Antivirus program. :ok: Take Care, Richard |
I have had this Trojan from CWS, its proved very irritating and all normal methods off deleting it have failed (ie. deleting the hacks its makes to the Registry etc, CWShredder etc ... it kept returning when I though I had killed it.
BUT ... finally yesterday it I am pretty sure I have clean system. Ad-ware and Housecall have in the last 24 hours issued updates which seem to be on the case .... run both off these and they should get rid off it for you .... http://housecall.trendmicro.com/hous...start_corp.asp Addware link (Lavasoft) download (check for updates when loaded). Also use...... to make sure .... Spybot Hope this works ..... PS : This forum is very useful and helpfull for this sort of stuff .. http://www.techsupportforum.com/ Good luck ! |
Guys,
Im in deep stuff here, Ive tried all of the above, and still have this re-direct problem. I do a full adaware scan which invariably finds a possible browser hijack and a registry value problem .. I delete the files, do a spybot scan which invariably finds 5 DSO exploits, again I remove them and ensure Im immunised. If I do another adaware scan straight away I have the same infected files again ... what the hell is happening ??? I have downloaded the latest plug in for the VX2 variant from adaware and it tells me my system is clean !!! Help !! :* |
whiz,
Did you follow the guide in the thread: Guide for Eliminating Spyware, Adware, and Random Popups Take Care, Richard |
Richard,
Yes, Ive followed that guide to the letter. After doing as asked I performed an adaware scan and got 6 problems.... one of which was the possible browser hijack. Since my first post I have also downloaded zonealarm, I was hoping that would sort the buggas, but to no avail. :mad: |
Hi Whiz,
There are quite a few variants of this now. When I came here I was asked (nicely, don't anyone get me wrong) :) that this forum didn't really want to get into more complex security issues, which I fully respect. :ok: You would be better off going to one of the dedicated security forums, such as... http://computercops.biz/forum67.html http://forums.techguy.org/f54-s.html or http://www.techsupportforum.com/foru...ne=&forumid=50 You'll get all the help you need.. and you might even get me.. :) (how much more bad luck could you have in one day.. :D:D) Cheers Liam --------------------------------------------------------------------------------- A member of the Alliance of Security Analysis Professionals since 2004. |
whiz,
I wanted to make sure all of the main options were covered before we continue to troubleshoot. It might be worth tossing the: McAfee AVERT Stinger At the problem. Now a little details about your computer would be helpful, as in which OS you are using and basic hardware specs. Take Care, Richard |
Hi Richard,
Operating system Windows XP Pro service pack 1 hardware as follows : AMD Athlon XP 2.8+ processor 512mb DDR 80 Gb HDD @ 7200 rpm Zone alarm has picked up nothing. Spybot repeatedly finds 5 DSO Exploits, I delete them and I do another spybot scan and they are back .. how the hell can the things be re-installing themselves ? Adaware also finds a possible browser hijack which I delete, but as soon as I connect to the internet its back :mad: |
When I came here I was asked (nicely, don't anyone get me wrong) that this forum didn't really want to get into more complex security issues, which I fully respect. |
Hi Evo,
Thanks for that.. :ok: It's just that in the first instance I always ask for a Hijack This log.. and so will any Security Forum worth it's salt. For any nerds they make great reading (who, me?) :8, but for general interest I would think that most don't want to see more than one or two. :) The other problem is attaching files to the posts. Most tools get out on the web pretty quickly, but others are written and uploaded straight to posts for use by the patient. It just means that sometimes scripts will have to be C&P'd into people's registries. All good stuff, and it works elsewhere.. :uhoh: I'm happy to do this if anyone wants though.. :) The site wouldn't get swamped in them, as there aren't many security problems arising. (Relative to TSG, TSF or CC) Certainly though, this latest batch of CWS variants would be nigh on impossible to fix otherwise. We could trial run Whiz's HJT, and if you think it detracts from the general ethos of the site, then we can leave it out. Your call Evo, and I'll agree whichever way. :ok: HJT. Yes or No? Cheers Liam |
whiz,
Do let Stinger try to remove the pests. If that does not help resolve the situation, it is time to use Liam's "Hijack This!" so we can see where the problem is located in your system. If we do not find it there, it is time to do a fresh install of WinXP on top of itself to sever the ties of the Malware with WinXP. (Then we can run all the programs, i.e. HouseCall, Ad-Aware, Spybot, Stinger, etc. and remove every pest in your system.) :ok: Take Care, Richard |
Richard, E-Liam
Many thanks for taking the time and effort to help, much appreciated. Evo, I fully understand and will comply with whatever you decide regarding HJT Richard, I tried the stinger, but it found nothing :confused: Awaiting instructions for the next move, oh and can someone please tell me what a hijack is ? :rolleyes: Edited to say I have downloaded the latest adaware update and scanned the system. 3 problems found, one of which was the usual possible browser hijack ... deleted 3 items and redid scan, possible browser hijack still there :* |
HJT. Yes or No? |
Here goes then.. :)
Hi Whiz, Please download 'Hijack This!' from here, unzip, and place it in it’s own folder, (not in the temp folder, or on the desktop) doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a reply. This will give us a rundown of what’s going on in your PC. One of us here will be glad to analyse it for you. Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required. A new version has just been released, so once you've got the program opened up, click on config | Misc Tools | Check for updates on line and follow the prompts. Cheers Liam |
E-Liam,
Ive done as asked but for some reason it wont let me post the reply here, its telling me I am using too many images, but all Im doing is pasting the file directly from the notepad :confused: |
I think that's all the URLs - PPRuNe thinks they're images or something. Try mangling them (ht tp, for example), should still be easy enough to read.
|
Hi Whiz,
Disable smileys before posting. C: \Windows for instance comes out as C:\Windows With so many file paths in the log, that's makes a lot of images (smileys) Cheers Liam |
E-Liam
Here we go, I tried the on line update, but got a server is down message, so Ive scanned with the downloaded version cheers Whiz Logfile of HijackThis v1.98.0 Scan saved at 11:19:06, on 02/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Radan Software\Radan 03\radan\bin\radlicence2.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger Plus! 3\MsgPlus.exe C:\PROGRA~1\SLOWHE~1\window mfcd.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Radan Software\Radan 03\radan\nt\i386\bin\dnc_manager.exe C:\Program Files\Radan Software\Radan 03\radan\bin\loguin.exe C:\Program Files\Radan Software\Radan 03\radan\bin\loguin.exe C:\PROGRA~1\INCRED~1\bin\IMApp.exe C:\Program Files\Radan Software\Radan 03\radan\bin\POUTPUT.exe C:\Program Files\Radan Software\Radan 03\radan\bin\POUTPUT.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\rsvp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: store title - {80ADFA92-EC2C-4FD5-30CC-ACA4E4DD39FC} - C:\PROGRA~1\FIRSTM~1\Bend Peak.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: dalesend - {16C2A31F-F4F5-A78F-9652-F14F747883CC} - C:\PROGRA~1\FIRSTM~1\Bend Peak.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [grimsafe] C:\PROGRA~1\SLOWHE~1\window mfcd.exe O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.8\THGuard.exe" O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE O4 - Global Startup: dnc_manager.lnk = C:\Program Files\Radan Software\Radan 03\radan\nt\i386\bin\dnc_manager.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/12b9f79a...p/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28177.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{06B03560-1269-46E0-A604-F2119B89962D}: NameServer = 213.1.119.100 213.1.119.99 O17 - HKLM\System\CS1\Services\Tcpip\..\{06B03560-1269-46E0-A604-F2119B89962D}: NameServer = 213.1.119.100 213.1.119.99 |
Hi Whiz,
No problem with the update.. Derek (who's site you downloaded it from) has got the latest version up now, and that's what you got.. :ok: :) I'm just off back to work, but it's definitely one of the latest CWS variants.. about:blank in the first entry is the give away. It's difficult to tell exactly which variant, but this should help me determine it. Please do this: Copy the contents of the bold text to Notepad. Name the file Appinit.bat Save as type All Files Save on the Desktop. Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv ren windows1.hiv windows.txt Double click on Appinit.bat This will create a file on the desktop named windows.txt Please copy and paste the contents of the Windows.txt file into your next reply. It will look strange but please paste it anyway. Also, could you let me know wheteher you are running XP home or Pro, and if it's on NTFS or FAT32. Cheers Liam Back in around 3 1/2 - 4 hours. |
E-Liam
Its all yours :D Im running XP Pro and NTFS file system regf Pugf hbin ¨ÿÿÿnk, œò_Wì Ä ÿÿÿÿ ÿÿÿÿÿÿÿÿ ø x ÿÿÿÿ 0 ‘%¯á WindowsáÈþÿÿsk x x ” ì ! € ! # € # ? ? ? Øÿÿÿvk € fùAppInit_DLLsÖ?æG ° Ðÿÿÿvk ÀUDeviceNotSelectedTimeoutðÿÿÿ1 5 ð ðÿÿÿ9 0 àN Ðÿÿÿvk €' zGDIProcessHandleQuota"þàÿÿÿvk € °ºSpooler2ðÿÿÿy e s Ñ_å ° à 0 ` ¨ àÿÿÿvk € 5swapdiskÐÿÿÿvk . TransmissionRetryTimeoutàÿÿÿ° à 0 ` ¨ È Ðÿÿÿvk €' ?áUSERProcessHandleQuotaƒá¸ |
Aah! There's ya problem......... :O
|
Hi Whiz,
Okay, it's not that one. (I went for the easiest one to spot.. that script shows a file name and path right after fùAppInit_DLLsÖ but that isn't the one.) Let's try and chase it out and clear up a couple of other problems in the meantime.. Please run a new HJT! Scan, and check to fix the following entries, being sure to double check that you haven't missed any. Next, close all browser windows and click the Fix checked button… R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank O2 - BHO: store title - {80ADFA92-EC2C-4FD5-30CC-ACA4E4DD39FC} - C:\PROGRA~1\FIRSTM~1\Bend Peak.dll O3 - Toolbar: dalesend - {16C2A31F-F4F5-A78F-9652-F14F747883CC} - C:\PROGRA~1\FIRSTM~1\Bend Peak.dll O4 - HKLM\..\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe See here O4 - HKLM\..\Run: [grimsafe] C:\PROGRA~1\SLOWHE~1\window mfcd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) Next, please double click on the My Computer icon on the desktop. Go to Tools | Folder Options, click on the View tab and make sure that Show hidden files and folders is checked. Also uncheck Hide protected operating system files. Now click Apply to all folders, then click Apply then OK. Then boot into safe mode, (see here for info if needed) and delete the entire contents of the C:\Windows\Temp folder, but not the folder itself. Next please find and delete the following bolded file... C:\WINDOWS\system32\syshost.exe ..and these folders... C:\PROGRA~1\FIRSTM~1 C:\PROGRA~1\SLOWHE~1 Then please boot back into normal mode and download AdAware 6 181 from here. Before you scan with AdAware, check for updates of the reference file by clicking Check for updates now, and following the prompts. Now to set it up for optimum performance... Make sure the following settings are configured. Remember that ON=GREEN. From main window click Start | Activate in-depth scan. Then click Use custom scanning options | Customize and have these options switched ON... Scan within archives Scan active processes Scan registryDeep scan registry Scan my IE Favourites for banned URLs Scan my host-files Then click the Settings button.. (the gear icon on the top row) then Tweak | Scanning engine and check.. Unload recognised processes during scanning. Cleaning engine. Let windows remove files in use at next reboot. and uncheck.. Automatically try to unregister objects prior to deletion. Then click Proceed, to save your settings. Now click the Scan button. When scan is finished, check the little box to the left of each entry to select them for removal, and get rid of them. Next, reboot again and download Spybot - Search & Destroy, from here: if you haven't already got the program. Click on Settings, and Settings again. Go to the Webupdate section, and check Display also available beta versions. Now press Online, and search for, and put a check mark next to all updates, and install following the prompts. Next, close all Internet Explorer windows, and click Check for Problems. Once the scan is complete, have SpyBot remove all it finds marked in RED. . Please go here and download, unzip and then open CoolWebShredder. Then click on the Updates button and follow the prompts. Next, run the program by clicking on the Fix-> button. CWS installs via the byte verifier exploit in M$ JavaVM so just surfing a page with an infected applet can install it with no user participation. So once you’ve run the above, it is vital that you go here, click Scan for updates in the main frame, and download and install all CRITICAL updates recommended. Also, a couple of queries... O4 - Global Startup: dnc_manager.lnk = C:\Program Files\Radan Software\Radan 03\radan\nt\i386\bin\dnc_manager.exe Is the above [Radan 03] CadCam software, or something else legit that you know you have..?? O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" And with reference to Messenger+3, you might want to read this... Once you've done all this lot, we'll see if that's got the bugger, so could you please post a new HJT log. One of the benefits of using HJT is that it can pick up things that get left out by the various scanning programs, such as that worm. Cheers Liam |
E-Liam,
Once again thanks a lot for taking the time and effort. Re your queries, yes radan is cadcam and the dnc manager is part of the system. I have uninstalled messenger+3 ! After the initial HJT scan and boot into safe mode I could not locate the file... C:\WINDOWS\system32\syshost.exe nor the folders... C:\PROGRA~1\FIRSTM~1 C:\PROGRA~1\SLOWHE~1 Below is todays HJT scan after carrying out the rest of your instructions Logfile of HijackThis v1.98.0 Scan saved at 10:10:17, on 03/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Radan Software\Radan 03\radan\bin\radlicence2.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger Plus! 3\MsgPlus.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Radan Software\Radan 03\radan\nt\i386\bin\dnc_manager.exe C:\Program Files\Radan Software\Radan 03\radan\bin\loguin.exe C:\PROGRA~1\INCRED~1\bin\IMApp.exe C:\Program Files\Radan Software\Radan 03\radan\bin\loguin.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HijackThis\HijackThis.exe O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.8\THGuard.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - Global Startup: dnc_manager.lnk = C:\Program Files\Radan Software\Radan 03\radan\nt\i386\bin\dnc_manager.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/12b9f79a...p/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28177.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{06B03560-1269-46E0-A604-F2119B89962D}: NameServer = 213.1.119.98 213.1.119.97 O17 - HKLM\System\CS1\Services\Tcpip\..\{06B03560-1269-46E0-A604-F2119B89962D}: NameServer = 213.1.119.98 213.1.119.97 cheers Whiz |
Hi Whiz,
Looking good. Messenger still seems to be running at start up. Please fix the following line... O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" ..and then look for and delete this folder if it's still there (the above may just be an orphaned registry entry)... C:\Program Files\Messenger Plus! 3 Re the other files/folders you couldn't find, once HJT had fixed them Adaware probably was able to atke them out. :ok: Your log is clean. Any more problems? Cheers Liam |
E-Liam,
No more problems. Once again a very big thanks for your help. If you're ever in the Cardiff area the beers are on me ... Cheers !! Whiz |
You're welcome Whiz.. :)
Cheers Liam |
whiz,
Glad to see you are all set now. Looks like once again, Liam to the rescue! ;) Take Care, Richard |
E-Liam if you are not too busy could you have a look at this please. I too have the dreaded DSO problem.
Logfile of HijackThis v1.98.0 Scan saved at 16:17:10, on 03/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe H:\Sygate\smc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RUNDLL32.EXE L:\djinn\gsyno.exe H:\Grisoft\avgcc32.exe W:\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Messenger\msmsgs.exe L:\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\WINDOWS\system32\spoolsv.exe H:\Naviscope\naviscope.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe H:\Grisoft\avgserv.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe l:\djinn\vstartx.exe W:\Norton Ghost 2003\GhostStartService.exe C:\Program Files\Microsoft ActiveSync\WCESMgr.exe l:\djinn\gisdnlog.exe V:\Nero\InCD\InCDsrv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe W:\Microsoft Office\Office10\OUTLOOK.EXE C:\Program Files\Internet Explorer\iexplore.exe K:\HiJack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:81 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - w:\adobe\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - L:\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [GazelDisplay] "l:\djinn\gsyno.exe" -h O4 - HKLM\..\Run: [SmcService] H:\Sygate\smc.exe -startgui O4 - HKLM\..\Run: [AVG_CC] H:\Grisoft\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [GhostStartTrayApp] W:\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] L:\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - Startup: naviscope.lnk = H:\Naviscope\naviscope.exe O4 - Startup: Shortcut to Reminder.lnk = L:\Anniversary\Reminder.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = W:\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://W:\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - W:\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - Thanks in advance Shack |
Help.
To avoid this falling off the bottom. Shack |
Hi Shack,
Please run a new HJT! Scan, and check to fix the following entries, being sure to double check that you haven't missed any. Next, close all browser windows and click the Fix checked button… R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm Then please reboot and post a new log. Cheers Liam |
Hi Liam
Herewith the new log. Thanks for you help. Cheers Shack Logfile of HijackThis v1.98.0 Scan saved at 10:59:32, on 06/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe H:\Sygate\smc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RUNDLL32.EXE L:\djinn\gsyno.exe H:\Grisoft\avgcc32.exe W:\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Messenger\msmsgs.exe L:\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE H:\Naviscope\naviscope.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe H:\Grisoft\avgserv.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe l:\djinn\vstartx.exe W:\Norton Ghost 2003\GhostStartService.exe l:\djinn\gisdnlog.exe V:\Nero\InCD\InCDsrv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe K:\HiJack\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:81 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - w:\adobe\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - L:\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [GazelDisplay] "l:\djinn\gsyno.exe" -h O4 - HKLM\..\Run: [SmcService] H:\Sygate\smc.exe -startgui O4 - HKLM\..\Run: [AVG_CC] H:\Grisoft\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [GhostStartTrayApp] W:\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] L:\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - Startup: naviscope.lnk = H:\Naviscope\naviscope.exe O4 - Startup: Shortcut to Reminder.lnk = L:\Anniversary\Reminder.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = W:\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://W:\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - W:\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - |
Hi Shack,
That's a clean log, so the next thing to is to download AdAware 6 181 from here. Before you scan with AdAware, check for updates of the reference file by clicking Check for updates now, and following the prompts. Now to set it up for optimum performance... Make sure the following settings are configured. Remember that ON=GREEN. From main window click Start | Activate in-depth scan. Then click Use custom scanning options | Customize and have these options switched ON... Scan within archives Scan active processes Scan registryDeep scan registry Scan my IE Favourites for banned URLs Scan my host-files Then click the Settings button.. (the gear icon on the top row) then Tweak | Scanning engine and check.. Unload recognised processes during scanning. Cleaning engine. Let windows remove files in use at next reboot. and uncheck.. Automatically try to unregister objects prior to deletion. Then click Proceed, to save your settings. Now click the Scan button. When scan is finished, check the little box to the left of each entry to select them for removal, and get rid of them. Next, reboot again and download Spybot - Search & Destroy, from here: if you haven't already got the program. Click on Settings, and Settings again. Go to the Webupdate section, and check Display also available beta versions. Now press Online, and search for, and put a check mark next to all updates, and install following the prompts. Next, close all Internet Explorer windows, and click Check for Problems. Once the scan is complete, have SpyBot remove all it finds marked in RED. Next reboot and go here, and run the online virus scan; choosing the Autoclean option just before clicking the Scan button. Then could you please let me know if you are still having problems. Cheers Liam |
Hi Liam
I followed your instructions, adaware found the usual couple of ad type cookies and Spybot once more found DSO Exploit with 5 parts. It then removes them but the next time I run Spybot either with or without a reboot it once more finds them. The housecall scan was clean. This is the latest log. Logfile of HijackThis v1.98.0 Scan saved at 15:28:31, on 07/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe H:\Sygate\smc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RUNDLL32.EXE L:\djinn\gsyno.exe H:\Grisoft\avgcc32.exe W:\Norton Ghost 2003\GhostStartTrayApp.exe C:\Program Files\Messenger\msmsgs.exe L:\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE H:\Naviscope\naviscope.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe H:\Grisoft\avgserv.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe l:\djinn\vstartx.exe W:\Norton Ghost 2003\GhostStartService.exe l:\djinn\gisdnlog.exe V:\Nero\InCD\InCDsrv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe K:\HiJack\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:81 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - w:\adobe\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - L:\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [GazelDisplay] "l:\djinn\gsyno.exe" -h O4 - HKLM\..\Run: [SmcService] H:\Sygate\smc.exe -startgui O4 - HKLM\..\Run: [AVG_CC] H:\Grisoft\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [GhostStartTrayApp] W:\Norton Ghost 2003\GhostStartTrayApp.exe O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] L:\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - Startup: naviscope.lnk = H:\Naviscope\naviscope.exe O4 - Startup: Shortcut to Reminder.lnk = L:\Anniversary\Reminder.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = W:\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://W:\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - W:\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - Sorry to be a pain. Shack |
Hi Shack,
The DSO exploits are showing because of a bug in Spybot. This will be fixed in the one of the next updates. It's happening to a lot of people at the moment. Other than that, you're squeaky clean.. :ok: :) BTW, you're not a pain.. :D this is my hobby.. :D Cheers Liam |
Hi Liam
Thanks for all your help, I was getting really bothered to have something that appeared to be un-deletable. It's my hobby as well but I am not as clever as you that's for sure. Thanks again Shack |
| All times are GMT. The time now is 13:58. |
Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.