Spyware probs - ad popups, redirects etc

Hi OG1


Download PocketKillbox
http://www.downloads.subratam.org/KillBox.zip
Unzip it
Restart your PC into Safe mode
double-click Killbox.exe
In the "Full path or file to delete" (paste the following)

C:\WINDOWS\SYSTEM32\nlsfuncs.exe

Click the red X to delete the file
If you get a cannot delete file message tick the box to delete
on reboot and answer no, you dont want to have it restart the pc..
Do that for each of these files one at a time.

C:\WINDOWS\SYSTEM32\iecust.exe
C:\WINDOWS\SYSTEM32\openconf.exe
C:\WINDOWS\SYSTEM32\pentxpl.exe
C:\WINDOWS\SYSTEM32\qappsrvc32.exe
C:\WINDOWS\SYSTEM32\taskopen.exe
C:\WINDOWS\SYSTEM32\unlodctl.exe
C:\WINDOWS\SYSTEM32\FNTCACHE.DAT
C:\WINDOWS\SYSTEM32\msqr.dll
C:\WINDOWS\SYSTEM32\iecust.dll
C:\WINDOWS\SYSTEM32\dnsauth.dll
C:\WINDOWS\SYSTEM32\dx9vbc.dll
C:\WINDOWS\SYSTEM32\msuv.dll
C:\WINDOWS\SYSTEM32\mswx.dll
C:\WINDOWS\SYSTEM32\msvw.dll
C:\WINDOWS\SYSTEM32\msfg.dll
C:\WINDOWS\SYSTEM32\menu.txt
C:\WINDOWS\SYSTEM32\msno.dll
C:\WINDOWS\SYSTEM32\msab.dll
C:\WINDOWS\SYSTEM32\hdon.dll
C:\WINDOWS\SYSTEM32\msxy.dll
C:\WINDOWS\HELP\CHMRedir.chm


Launch Notepad, and copy and paste the Bolded below into a new text file.
Save it as file name: "fixme.reg" (not including the quotes). Save as file type: All files (*.*) and save it on your Desktop.
edit out the space in Curr entVersion first, our forum breaks it like that.


REGEDIT4

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Vd]
[-HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000000}]
[-HKEY_CLASSES_ROOT\CLSID\{06ABAA2D-34AB-4902-A326-409BD9B9A7A5}]
[-HKEY_CLASSES_ROOT\CLSID\{449D7DC0-51DB-11D9-83CE-C2CE30591F4E}]
[-HKEY_CLASSES_ROOT\CLSID\{98DBBF16-CA43-4c33-BE80-99E6694468A4}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Hd]

Now double-click on the fixme.reg file you saved and click on the Yes button when it asks if you would like to merge the information.
Did you get a sucessfull message ?



Reboot back to a normal windows session
Download and run DelDomains.inf , found here
http://www.mvps.org/winhelp2002/restricted.htm
Afterward's you should re-immunize again in SpyBot and re-protect against all with SpywareBlaster.

make/post a new hijackthis log please

 

Ok I've done all that, here are the results. Killbox was able to delete all those files except the following, which it said 'didn't seem to exist':

C:\WINDOWS\SYSTEM32\msuv.dll
C:\WINDOWS\SYSTEM32\msqr.dll
C:\WINDOWS\SYSTEM32\mswx.dll
C:\WINDOWS\SYSTEM32\msvw.dll
C:\WINDOWS\SYSTEM32\msfg.dll
C:\WINDOWS\SYSTEM32\menu.txt
C:\WINDOWS\SYSTEM32\msno.dll
C:\WINDOWS\SYSTEM32\msab.dll
C:\WINDOWS\SYSTEM32\hdon.dll
C:\WINDOWS\SYSTEM32\msxy.dll

The regedit file was successfully merged.

I ran deldomains and since then those two sites have disappeared from the trusted sites section in internet options.

Spybot has been updated and immunized; spyware blaster updated likewise and all protection enabled.

Strangely a file called !Submit has now appeared in C:\

On restarting from safe mode I got the following windows message - something to the effect of 'Windows can't find qappsrvc32.exe. Make sure you have typed the file name correctly. Try searching again. To search, click on start and then search.'

Things are looking good, I haven't experienced any of the problems since doing this... *fingers crossed*

Anyway, here is the latest hijackthis log:

Logfile of HijackThis v1.99.0
Scan saved at 09:44:12, on 20/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BT Broadband\Help\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\Anti Spyware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://fastsearchweb.com/srh.php?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/Default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: (no name) - {04E1914D-CAC1-45EB-97C9-B6B6B562BF68} - C:\WINDOWS\system32\mshi.dll
O3 - Toolbar: (no name) - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - (no file)
O4 - HKLM\..\Run: [taskopen.exe] taskopen.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1102882800261
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E80663C1-7BCC-4460-A4ED-09920EEFAC55}: NameServer = 194.72.9.34 194.74.65.68
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

 

Great

Run Agent Rasack and do the same search we had you do before, but uncheck search subfolders

Start Hijackthis and place a check next to these items,
Close all browser windows and shut down all other programs that show in the taskbar. (even Folders) Then Hit fix checked.
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = -=http://fastsearchweb.com/srh.php?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {04E1914D-CAC1-45EB-97C9-B6B6B562BF68} - C:\WINDOWS\system32\mshi.dll
O3 - Toolbar: (no name) - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - (no file)
O4 - HKLM\..\Run: [taskopen.exe] taskopen.exe
=============close Hijackthis
Delete the contents of all your temp folders, as in. Open C:\ then >
C:\documents and settings\(all your pc users)\local settings\temp
Note: Some systems have temporary internet files, Application Data and History in that temp, if so leave them and delete all other folders and files inside that temp..
Delete the contents of the C:\windows\temp folder
C:\WINDOWS\Prefetch < delete the contents
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temp <delete the contents
Clear Internet Explorers's cache
1. In Control Panel, open Internet Options.
2. Click the General tab, and then under Temporary Internet files, click Delete Files.
3. In the Delete Files dialog box, click to select the Delete all offline content check box.
4. wait for the hourglass to disapear
5. Click OK.


Was that log taken in safe mode ?
dont connect while i safe mode

I see no anti virus program ?

 

Done that - files seem to have fixed without trouble in hijackthis, dealt with all the temp stuff I think... not sure what you want me to do with agent ransack though...

You see no antivirus program because I haven't got one, far too expensive! The log wasn't taken in safe mode, no.

Edit - I think the problems associated with this spyware are entirely gone now, I've experienced no popups, trusted site problems, redirects etc all morning, and I've left the computer alone for several hours just to check that nothing has appeared when I get back. So thanks a lot! Would be nice to get rid of any lingering suspicious files, but like I say, the problem is no longer noticeable or intrusive in any way.

 

Good

Run Agent Rasack, in the Look in field paste in C:\WINDOWS\SYSTEM32
check the box [X] Modified 12/1/2004 (or the time you think the infection started) leave the before box unchecked, >> Uncheck the search sub folders box, click start search, when its complete go file save result's here the tricky part,
[*] < tick file, use the folder icon to browser to you desktop or somewhere handy.
Under the save information area [ ] uncheck contents then save it

Baskar a freind or ours is (thanks to you sbmitting the files) making a tool to cleanup all the other files it probaly made, we will get back with you one that.

In the meantime install a free av program, update it then do a full system scan.

 

Here's the agent ransack file:

C:\WINDOWS\SYSTEM32\bits (12/12/2004 20:25:31)
C:\WINDOWS\SYSTEM32\CatRoot (13/12/2004 17:49:24)
C:\WINDOWS\SYSTEM32\CatRoot2 (18/12/2004 13:28:57)
C:\WINDOWS\SYSTEM32\Com (13/12/2004 17:25:43)
C:\WINDOWS\SYSTEM32\dllcache (13/12/2004 17:33:05)
C:\WINDOWS\SYSTEM32\drivers (17/12/2004 23:19:28)
C:\WINDOWS\SYSTEM32\FNTCACHE.DAT (114 KB, 20/12/2004 09:31:31)
C:\WINDOWS\SYSTEM32\hdlk.dll (16 KB, 16/12/2004 21:16:28)
C:\WINDOWS\SYSTEM32\hdxw.dll (16 KB, 20/12/2004 09:05:26)
C:\WINDOWS\SYSTEM32\inetsrv (13/12/2004 17:55:45)
C:\WINDOWS\SYSTEM32\msde.dll (12 KB, 16/12/2004 22:06:15)
C:\WINDOWS\SYSTEM32\mshi.dll (12 KB, 20/12/2004 09:05:24)
C:\WINDOWS\SYSTEM32\nlsfunc.zip (5 KB, 18/12/2004 13:18:14)
C:\WINDOWS\SYSTEM32\npp (13/12/2004 17:25:54)
C:\WINDOWS\SYSTEM32\oobe (13/12/2004 17:32:09)
C:\WINDOWS\SYSTEM32\pentxpl.zip (91 KB, 19/12/2004 15:34:35)
C:\WINDOWS\SYSTEM32\perfc009.dat (40 KB, 13/12/2004 18:00:27)
C:\WINDOWS\SYSTEM32\perfh009.dat (305 KB, 13/12/2004 18:00:27)
C:\WINDOWS\SYSTEM32\PerfStringBackup.INI (348 KB, 13/12/2004 18:00:27)
C:\WINDOWS\SYSTEM32\ReinstallBackups (13/12/2004 17:18:40)
C:\WINDOWS\SYSTEM32\rem.bat (30 KB, 16/12/2004 21:04:55)
C:\WINDOWS\SYSTEM32\Restore (13/12/2004 17:25:55)
C:\WINDOWS\SYSTEM32\Setup (13/12/2004 17:32:47)
C:\WINDOWS\SYSTEM32\spupdwxp.log (1 KB, 13/12/2004 17:54:20)
C:\WINDOWS\SYSTEM32\usmt (13/12/2004 17:24:45)
C:\WINDOWS\SYSTEM32\wbem (13/12/2004 17:54:24)
C:\WINDOWS\SYSTEM32\wpa.dbl (3 KB, 16/12/2004 21:08:10)
C:\WINDOWS\SYSTEM32\zip.exe (124 KB, 19/12/2004 19:08:07)
C:\WINDOWS\SYSTEM32\ZipbadFile.bat (1 KB, 19/12/2004 19:08:07)
C:\WINDOWS\SYSTEM32\ZipSuspectfiles (19/12/2004 19:08:25)

 

Hello

Delete these files

C:\WINDOWS\SYSTEM32\FNTCACHE.DAT
C:\WINDOWS\SYSTEM32\hdlk.dll
C:\WINDOWS\SYSTEM32\hdxw.dll
C:\WINDOWS\SYSTEM32\msde.dll
C:\WINDOWS\SYSTEM32\mshi.dll
C:\WINDOWS\SYSTEM32\nlsfunc.zip
C:\WINDOWS\SYSTEM32\pentxpl.zip
C:\WINDOWS\SYSTEM32\rem.bat
C:\WINDOWS\SYSTEM32\zip.exe
C:\WINDOWS\SYSTEM32\ZipbadFile.bat
C:\WINDOWS\SYSTEM32\ZipSuspectfiles
Were you able to ?

Post one more Hijackthis log please

 

All those files were deleted successfully. Here's the log:

Logfile of HijackThis v1.99.0
Scan saved at 12:40:20, on 21/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BT Broadband\Help\bin\mpbtn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\Anti Spyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/Default.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1102882800261
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E80663C1-7BCC-4460-A4ED-09920EEFAC55}: NameServer = 194.72.9.34 194.74.65.68
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

 

Looks good, except still no AV program, good work !!

 

All sorted then? What about !Submit in c:\?

Thanks a lot for all your help, it's nice to have a usable computer again!

 

Yes by all means delete that folder

Regards