Checking after spyware removal

ozmart2004 · 2004/12/08

I had a nasty addware toolbar (together with a bunch of trojans) on my machine earlier today. I cleaned it out with Ad Aware, Spybot and Trojan Hunter, plus I uninstalled the toolbar. I also cleaned out the temp folder and looked in the registry and got rid of a couple of things.

Last couple of re-boots I noticed that a running process/app called something like "Hidden shell" (it only flashes up quicly) gets shutdown. I can't find anything on it, but I ran a little utilty called 'Startup List" and I say this one thing that looks a bit odd. There is no INI section for a few things. Can anyone tell me if this is normal or not?:

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
Click to expand...

Otherwise I think its clear now, but would like to make sure!
Thks
Martin

PS Below is the full text of startupist

StartupList report, 9/12/2004, 12:33:00 AM
StartupList version: 1.52
Started from : D:\Startup List\StartupList.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Canon\BJCard\Bjmcmng.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Telstra\Toolbar\bpumTray.exe
C:\PROGRA~1\mcafee\SPAMKI~1\spamkiller.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\PS Hot Launch VVL\PSHotLaunchVVL.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\MemTurbo30\MemTurbo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe
C:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Startup List\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Martin\Start Menu\Programs\Startup]
MemTurbo.lnk = C:\Program Files\MemTurbo30\MemTurbo.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
Lotus Organizer EasyClip.lnk = ?
Quicken Scheduled Updates.lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

BJLaunchEXE = C:\Program Files\Canon\BJCard\BJLaunch.exe
IntelliPoint = "C:\Program Files\Microsoft IntelliPoint\point32.exe "
IntelliType = "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe "
WINDVDPatch = CTHELPER.EXE
UpdReg = C:\WINDOWS\UpdReg.EXE
Jet Detection = "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
DU Meter = C:\Program Files\DU Meter\DUMeter.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
THGuard = "C:\Program Files\TrojanHunter 4.0\THGuard.exe "
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
URLLSTCK.exe = C:\Program Files\Norton Internet Security\UrlLstCk.exe
Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
BigPond Toolbar = "C:\Program Files\Telstra\Toolbar\bpumTray.exe "
MSKExe = c:\PROGRA~1\mcafee\SPAMKI~1\spamkiller.exe
MCUpdateExe = C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
PinnacleDriverCheck = C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
LogitechVideoRepair = C:\Program Files\Logitech\Video\ISStart.exe
LogitechVideoTray = C:\Program Files\Logitech\Video\LogiTray.exe
MimBoot = C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

Register Homesite+.exe = "C:\Program Files\Macromedia\HomeSite+\Homesite+.exe" /REGSERVER

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PS Hot Launch VVL = C:\Program Files\PS Hot Launch VVL\PSHotLaunchVVL.exe
Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
Skype = "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
LDM = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
Eyeball Chat = "C:\Program Files\Eyeball\Eyeball Chat\EyeballChat.exe" -min
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll - {00C6482D-C502-44C8-8409-FCE54AD9C208}
(no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\GetRight\xx2gr.dll - {31FF080D-12A3-439A-A2EF-4BA95A3148E8}
(no name) - C:\Program Files\Telstra\Toolbar\bpumToolBand.dll - {4C7B6DE1-99A4-4CF1-8B44-68889900E1D0}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
Web assistant - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll - {9ECB9560-04F9-4bbc-943D-298DDF1699E1}
(no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}
NAV Helper - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
SpoofStick BHO - C:\Program Files\CoreStreet\SpoofStick\SpoofStickBHO.dll - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE}

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 9,401 bytes
Report generated in 0.901 seconds
Click to expand...

surferdude2 · 2004/12/08

Not to worry, here's mine:

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
Click to expand...

I would suggest that you get SpywareBlaster to keep the meanies off your drive in the first place. It runs seamlessly and silently to block malwares from coming aboard. Your only obligation is to update it occasionally. The current database contains 3244 item it protects against.

ozmart2004 · 2004/12/08

OK, thks a lot.

Newt · 2004/12/08

just saw surferdude2's reply. Gonna post my comments anyway but you can certainly trust what he says

Depends on how your system got to the OS version is has today. If a fresh load of XP on a clean drive, I'm really surprised to see quite a few of those entries in the file at all. If an upgrade from an earlier OS version that actually used system.ini to operate the OS, they are probaly just items that weren't needed any longer.

Both the systemroot\System.ini and systemroot\Win.ini files are not required by Windows XP Professional and these files are maintained only for compatibility with older software that does not use the registry to save settings. The System.ini file is used to start and store information for drivers and services; the Win.ini file plays a similar role for applications.
Click to expand...

From looking at your startup stuff I do see a couple of things worth mention though.

The sun java version you have is way out of date and you need to upgrade to the newest. Lots of security improvements.

XP does not need, does not benefit from, and can be made less stable by products like memturbo. XP handles the memory issues nicely where as some earlier OS versions didn't. I'd suggest getting rid of the app.

If you'd like a 2nd opinion on how well your cleaning went, a log from the current version of Hijackthis would let us take a good look.

Log in or Sign up

Checking after spyware removal

ozmart2004 Inactive Thread Starter

surferdude2 Inactive

ozmart2004 Inactive Thread Starter

Newt Inactive

Share This Page

Log in or Sign up

Checking after spyware removal

ozmart2004 Inactive Thread Starter

surferdude2 Inactive

ozmart2004 Inactive Thread Starter

Newt Inactive

Share This Page

Useful Searches