Spyware probs - ad popups, redirects etc

For the last few days I've been struggling to get rid of some spyware I've managed to pick up. Symptoms are:

Ad popups for things like strip poker at girlsforgames.com, insurance ads, spyware removal software. These appear even when I'm offline - though the images themselves don't show up, just the windows when offline.

A random popup both on and offline saying 'click yes to download free software'. The only option is ok or the cross in the right hand corner. Clicking both makes this popup repeat a few times before giving me an option to accept. As if I would.

A supposedly fake message from windows security centre (I've seen it referred to as fake in other messages about similar problems). This tells me I need to download certificated anti-spyware software.

Sometimes I get an about:blank homepage.

Edit - random but regular browser redirects to **** type sites also occur when I click on an ordinary link to a normal site. This isn't all that frequent but is still a pain.

Even when I remove them from trusted sites, http://*.63.219.181.7 and http://*.search-soft.net return.

A message from XP pops up in a speech bubble in the bottom right periodically saying your spyware status is bad or something.

As I said, I've read a few old threads about this kind of problem but emulating advice offered in thise hasn't resulted in a solution for me. I've tried hijack this, cw shredder, reg seeker, ad-aware se personal and spybot S&D both in normal and safe mode where possible and had no luck in solving the problem.

Anyway here's the latest HijackThis log, any help would be much appreciated. Fast help, if possible.

Logfile of HijackThis v1.99.0
Scan saved at 12:18:23, on 17/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BT Broadband\Help\bin\mpbtn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\unlodctl.exe
C:\WINDOWS\system32\nlsfuncs.exe
C:\WINDOWS\system32\pentxpl.exe
C:\WINDOWS\system32\openconf.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\admin\Desktop\Anti Spyware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://fastsearchweb.com/srh.php?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/Default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\system32\iecust.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.63.219.181.7
O15 - Trusted Zone: http://*.search-soft.net
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1102882800261
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E80663C1-7BCC-4460-A4ED-09920EEFAC55}: NameServer = 194.72.9.34 194.74.65.68
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

 

Hello

If possible zip up and send those files to me
C:\WINDOWS\system32\unlodctl.exe
C:\WINDOWS\system32\nlsfuncs.exe
C:\WINDOWS\system32\pentxpl.exe
C:\WINDOWS\system32\openconf.exe

If you cannot see them download this zip file
ZipBadFiles.zip
http://forums.net-integration.net/index.php?act=Attach&type=post&id=121123
unzip and files inside ZipbadFile.bat and zip.exe to the system32 folder . put the other [look.bat] on your desktop ,then run ZipbadFile.bat
That will make a file called C:\bad.zip Send >To This address< Put a password on it if you know how if not try to send anyway please.

You will need to Run look.bat while the PC is in safe mode
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx
Run the look.bat then a text will open, if look txt has any content save it
if there is no content, we will try another aproach
Restart the PC back to normal and post it .

 

I've done what you said and couldn't see the files in system 32. But running ZipBadFile.bat doesn't produce a file in c:\ called bad.zip. Setting the computer to show hidden and sytem files doesn't reveal anything either or make the zipbadfile program any more successful.

The dos type file that appears when you run zipbadfile.bat says that the file names it's searching for are not matched and a zip error is recorded - file not found.

I think a different approach is needed. Thanks for trying though, the help is much appreciated.

 

Just thought I'd mention this - there are exe files with similar names to the ones you listed in system 32, don't know if they're worth a look?

odbcconf.exe
nlsfunc.exe
unlodctr.exe
pentnt.exe

I tried zipping up nlsfunc but ended up just making a couple of copies of it which I now can't delete so it'd be useful to know how to remove them.

 

Ok, the files are hidding themselves, run that bat file while in safe mode.
restart back to normal and let us know what happend,
Just to check you did unzip both files inside to the system32 folder ?

Edit just noticed your last reply
yes send those to if possible
odbcconf.exe
nlsfunc.exe
unlodctr.exe
pentnt.exe

Later we will need to know where at exactly the copies you made are that cant be deleted manualy

 

Ok I've sent you the 'bad.zip' file. I can't compress those other files into a zip folder so I haven't sent them to you. I followed the instructions in windows help (open a drive, click new and then compressed folder but the option wasn't there.

Edit - the look text file was blank.

 

Thanks, Files recieved

Im sending them to a couple expert's who can test them on an NT system.
we will be back with you
delete bad.zip and ZipbadFile.bat, if you dont mind, ive changed the ZipBadFile.bat to grab copies of those other files, same deal unzip ,place them in system32 folder reboot into safe mode run ZipbadFile.bat, reboot back to normal before going back online, and send them to us
http://forums.net-integration.net/index.php?act=Attach&type=post&id=121123

 

Ok, I've sent the bad.zip of those new files. Look again produced a blank text file. Any idea when you're likely to post more advice so I know when to check back?

 

OG1 - you can set the thread to notify you via email whenever there is a response. Might be a good idea in this case.

 

Hello

Im still waiting fro the word on that nastie.,, dont attempt to delete any of those files, a couple were lagitamate.


Delete ZipBadFiles.zip ZipbadFile.bat and zip.exe

Untill the experts get back with us do this please, then we might now what other files are involved and get sample's of them also.
Download and unzip "Find_Upx_.zip "
Open the Find-Upx folder and run the Upx!.bat
wait, a Log.txt will open, post it back here.
http://forums.skads.org/index.php?showtopic=98

 

Ok, I've done that - here's the log.txt.

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------

Files Found in windows Folder............
------------------------
C:\WINDOWS\system32\HiperLoader.ocx: UPX!
C:\WINDOWS\system32\iecust.exe: UPX!
C:\WINDOWS\system32\ntdll.dll: .aspack
Finished

 

Hello

Would you Open the system32 folder (in safe mode) sort by date
look for the files that were process's in your log
C:\WINDOWS\system32\unlodctl.exe
C:\WINDOWS\system32\nlsfuncs.exe
C:\WINDOWS\system32\pentxpl.exe
C:\WINDOWS\system32\openconf.exe

This is part of the package iecust.exe

If your comfortable do a registry search for the knwn bad files above, if found
at other than an mru location, export the whole branch then once back in normal windows startup post it here.

As for the files: Place them all in a zip and send them to us (same address). if we can get the thing to install we will no exactly how to deal with it.

 

Same problem

I do second level support at my firm and ran across a workstation on
Friday with the same issues. Two of the hidden files/processes are getdns.exe and pingnet.exe with the same issue of them being basically invisible. The same .63 trusted zone keeps coming back as well as a couple of DPF entries. The iecust.dll was also present, but I was able to get rid of that. What is trippy is that when you try to run Lavasoft Adaware or Regedit to delete the entries regedit errors out and Lavasoft adaware closes when you try to quarantine the files it found. This is the worst malware I have ran across, and actually the only one I haven't been able to get rid of. One of our Information Security techs is working with Microsoft and Symantec to resolve this. I will post any results here.

 

Don't understand what you want me to do in the registry, and I've just realised I sent you the exe files with similar names to the ones you've named in your last post, not the ones you actually meant.

 

Ok, I've sent the zip from system 32 that contained those bad files. I think it also contains a couple of others.

 

Ok Lets go about it in another way

Download and install agent ransack (its free) its a search tool, much better that win XP's.
start the program, search for
unlodctl.exe
You will see what date it was created, for instance 12/4/2004
remember that, back space out unlodctl.exe in the top field, in
In the look in field type in C:\windows\system32
the check Modified box [X] look for files for just that date
then click start search, no need to do that in safe mode.
once the search is finished, go file > save results [x] file use the browse button to save it to your desktop
[x] file name is marked
uncheck [ ] file contents
click save
Agent Ransack -
http://www.mythicsoft.com/agentransack/download.aspx
Post that back here, then i can fashion a batch file to have you run while in safe mode to gather all te files.

 

Welcome to WindowsBBS Gena

You will probably find a list of files to search for at the following key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ms4Hd

You must boot to safe mode to see it and once removed the files will be visible in the system32 folder. **Not all of the files listed will be present.

The offending trusted zone entries can be found at the following locations.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

 

Hi all

Sorry to butt in, but I think if OG1 was to run FindIt as suggested in this post, those newly created files should show right up.

 

Hi
That tools for a whole other nastie, it might show us some packed files,

Anyway

OG1 I updated the ZipBadFiles.zip
http://forums.net-integration.net/index.php?act=Attach&type=post&id=121123

Same drill download and extract that to the system32 folder overwriting whats there. delete C:\bad.zip

restart the PC into safe mode then run ZipbadFile.bat
restart back to a normal windows session send me the bad zip
But this time place a password on it
If you dont know how wait and tell us what you use as a zip program, for XP built in zip

 

Ok, done all that. Here's the agent ransack file for the date of unloctl.exe:

C:\WINDOWS\system32\bits (12/12/2004 20:25:31)
C:\WINDOWS\system32\oobe\images\greenshd.gif (3 KB, 12/12/2004 21:38:05)
C:\WINDOWS\system32\oobe\images\redshd.gif (3 KB, 12/12/2004 21:38:05)

I noticed there was another file that appeared when I searched for unlodctl.exe but which was created the day after. It was called unlodctl.exe-11FF4A4B.pf. Here's the agent ransack file for that date.

I'll email you the bad.zip now.

C:\WINDOWS\system32\bits (12/12/2004 20:25:31)
C:\WINDOWS\system32\CatRoot (13/12/2004 17:49:24)
C:\WINDOWS\system32\Com (13/12/2004 17:25:43)
C:\WINDOWS\system32\dllcache (13/12/2004 17:33:05)
C:\WINDOWS\system32\FNTCACHE.DAT (114 KB, 13/12/2004 17:53:32)
C:\WINDOWS\system32\inetsrv (13/12/2004 17:55:45)
C:\WINDOWS\system32\npp (13/12/2004 17:25:54)
C:\WINDOWS\system32\oobe (13/12/2004 17:32:09)
C:\WINDOWS\system32\perfc009.dat (40 KB, 13/12/2004 18:00:27)
C:\WINDOWS\system32\perfh009.dat (305 KB, 13/12/2004 18:00:27)
C:\WINDOWS\system32\PerfStringBackup.INI (348 KB, 13/12/2004 18:00:27)
C:\WINDOWS\system32\ReinstallBackups (13/12/2004 17:18:40)
C:\WINDOWS\system32\Restore (13/12/2004 17:25:55)
C:\WINDOWS\system32\Setup (13/12/2004 17:32:47)
C:\WINDOWS\system32\spupdwxp.log (1 KB, 13/12/2004 17:54:20)
C:\WINDOWS\system32\usmt (13/12/2004 17:24:45)
C:\WINDOWS\system32\wbem (13/12/2004 17:54:24)
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache (13/12/2004 17:35:57)
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content (13/12/2004 17:35:57)
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData (13/12/2004 17:35:57)
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (1 KB, 13/12/2004 17:35:57)
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (1 KB, 13/12/2004 17:35:57)
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat (16 KB, 13/12/2004 17:54:22)
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5 (13/12/2004 17:54:15)
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat (32 KB, 13/12/2004 17:54:22)
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012004121320041214 (13/12/2004 17:54:15)
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012004121320041214\index.dat (32 KB, 13/12/2004 17:54:15)
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat (32 KB, 13/12/2004 17:54:22)
C:\WINDOWS\system32\Macromed\Flash (13/12/2004 17:20:59)
C:\WINDOWS\system32\mui\0401 (13/12/2004 17:32:48)
C:\WINDOWS\system32\mui\0402 (13/12/2004 17:32:49)
C:\WINDOWS\system32\mui\0404 (13/12/2004 17:32:49)
C:\WINDOWS\system32\mui\0405 (13/12/2004 17:32:50)
C:\WINDOWS\system32\mui\0406 (13/12/2004 17:32:50)
C:\WINDOWS\system32\mui\0407 (13/12/2004 17:32:51)
C:\WINDOWS\system32\mui\0408 (13/12/2004 17:32:52)
C:\WINDOWS\system32\mui\040b (13/12/2004 17:32:53)
C:\WINDOWS\system32\mui\040C (13/12/2004 17:32:53)
C:\WINDOWS\system32\mui\040D (13/12/2004 17:32:54)
C:\WINDOWS\system32\mui\040e (13/12/2004 17:32:54)
C:\WINDOWS\system32\mui\0410 (13/12/2004 17:32:55)
C:\WINDOWS\system32\mui\0411 (13/12/2004 17:32:56)
C:\WINDOWS\system32\mui\0412 (13/12/2004 17:32:57)
C:\WINDOWS\system32\mui\0413 (13/12/2004 17:32:57)
C:\WINDOWS\system32\mui\0414 (13/12/2004 17:32:44)
C:\WINDOWS\system32\mui\0415 (13/12/2004 17:32:58)
C:\WINDOWS\system32\mui\0416 (13/12/2004 17:32:59)
C:\WINDOWS\system32\mui\0418 (13/12/2004 17:32:59)
C:\WINDOWS\system32\mui\0419 (13/12/2004 17:32:59)
C:\WINDOWS\system32\mui\041a (13/12/2004 17:32:59)
C:\WINDOWS\system32\mui\041b (13/12/2004 17:33:00)
C:\WINDOWS\system32\mui\041D (13/12/2004 17:33:01)
C:\WINDOWS\system32\mui\041e (13/12/2004 17:33:01)
C:\WINDOWS\system32\mui\041f (13/12/2004 17:33:01)
C:\WINDOWS\system32\mui\0424 (13/12/2004 17:33:02)
C:\WINDOWS\system32\mui\0425 (13/12/2004 17:33:02)
C:\WINDOWS\system32\mui\0426 (13/12/2004 17:33:02)
C:\WINDOWS\system32\mui\0427 (13/12/2004 17:33:02)
C:\WINDOWS\system32\mui\0804 (13/12/2004 17:33:03)
C:\WINDOWS\system32\mui\0816 (13/12/2004 17:33:04)
C:\WINDOWS\system32\mui\0C0A (13/12/2004 17:33:04)
C:\WINDOWS\system32\oobe\images (13/12/2004 17:32:08)
C:\WINDOWS\system32\oobe\setup (13/12/2004 17:32:09)
C:\WINDOWS\system32\oobe\images\greenshd.gif (3 KB, 12/12/2004 21:38:05)
C:\WINDOWS\system32\oobe\images\redshd.gif (3 KB, 12/12/2004 21:38:05)
C:\WINDOWS\system32\ReinstallBackups\0002 (13/12/2004 17:18:40)
C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles (13/12/2004 17:18:41)
C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386 (13/12/2004 17:18:41)
C:\WINDOWS\system32\spool\drivers\w32x86 (13/12/2004 17:05:20)
C:\WINDOWS\system32\wbem\AutoRecover (13/12/2004 17:57:04)
C:\WINDOWS\system32\wbem\Performance (13/12/2004 18:00:27)
C:\WINDOWS\system32\wbem\AutoRecover\6FFF7467A5B40765D5740A413CA8BB8A.mof (9 KB, 13/12/2004 17:57:04)
C:\WINDOWS\system32\wbem\AutoRecover\C3A0BE17B37ACE48BE78B31580231AE9.mof (87 KB, 13/12/2004 17:57:04)
C:\WINDOWS\system32\wbem\Logs\FrameWork.log (1 KB, 13/12/2004 11:50:42)
C:\WINDOWS\system32\wbem\Logs\mofcomp.log (12 KB, 13/12/2004 17:57:04)
C:\WINDOWS\system32\wbem\Logs\replog.log (1 KB, 13/12/2004 17:55:04)
C:\WINDOWS\system32\wbem\Logs\setup.log (6 KB, 13/12/2004 17:33:59)
C:\WINDOWS\system32\wbem\Logs\WinMgmt.log (21 KB, 13/12/2004 16:39:41)
C:\WINDOWS\system32\wbem\Logs\wmiadap.log (1 KB, 13/12/2004 17:59:34)
C:\WINDOWS\system32\wbem\Performance\WmiApRpl.h (1 KB, 13/12/2004 18:00:27)
C:\WINDOWS\system32\wbem\Performance\WmiApRpl.ini (3 KB, 13/12/2004 18:00:27)
C:\WINDOWS\system32\wbem\Repository\FS (13/12/2004 17:54:25)