DSO Exploit/HKRY_User

Or soemthing like it. I know, i know, I still have another topic, however I got some new problems

After recently scanning with SPYBOT, I went looking for more info. I found this.

-------
Solution:
There is no configuration-tweaking workaround for this bug, it will work as long as the browser parses HTML. The only possible solution must come in the form of a patch from Microsoft.

Update - 3 Mar 2002

Since the injected <object> runs in the "My Computer" Zone changing the Internet Zone's settings couldn't affect it, but changing the affected zone's settings will prevent this exploit from running.

Here is the registry information:

[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings \ Zones \ 0]
Change the value of "1004" (DWORD) to 3.

Many thanks to Axel Pettinger and Garland Hopkins for this workaround
-------

However, I cannot seem to find were to replace the "3" or find anywhere else to selve it

Help is much appreciated. SPYBOT,ADAWARE, SPYSWEEPER, and NORTON don;t kill this off

I got this message of SPYBOT

 

Thanks, but I'm still having problems

Every time a new window opens/closes, SPYSWEEPER alerts me of changing hope pages and search pages

Every time I am on the computer CWS-About Blank, CWS sp.html, and CWSCoolWebSearch come back. Every single time.

CWS shredder finds CWS. Search X, but never the others. HiJack This repairs it, but it always comes back

I dunno why, but it always comes back.

 

First, make sure you have the latest version of CWShredder. Second, download AboutBuster from one of the following locations.


http://www.atribune.org/downloads/AboutBuster.zip

http://tools.zerosrealm.com/AboutBuster.zip

http://www.downloads.subratam.org/AboutBuster.zip

If you are using the TeaTimer option in Spybot, disable it. Turn off system restore, close ALL other windows, open CWShredder and click fix.

Unzip AboutBuster to a folder or your desktop. Double click AboutBuster.exe and click ok, then update. A new screen should popup. On that screen click Check for Updates. If it says it found an update click Download Updates. If it doesn't, it will automatically tell you and exit.

Reboot to safe mode. Again, open and run AboutBuster (skip the update).
Click start and then Ok. The program should start scanning. Wait for it to finish (may take a while), then hit exit and reboot.

Once rebooted run About:Buster once more to make sure everything is ok.

Are you up-to-date with Windows Update? Are you using MS Virtual Java Machine or Sun Java?

 

Hmm...not sure. The thing 'Sun Java' seems familiar.

I run XP and the latest version of Internet Explorer.

I will try your method

 

I know, double post. Sorry, but I gotta update on something

I can't get into Safe Mode. Whenever I do Start>Run>msconfig, it says 'The memory could not be written. Click of to terminate the program'

 

There are several other ways to boot into safe mode.

- When you reboot, you will see (briefly) a couple of options for boot choices, selectable by pressing a function key. Depending on the make of your PC, it could be F1, F2, F8, F12.

- You can also edit boot.ini file and add a line like the bottom one in mine along with a timeout that gives you enough time to make a selection. Not quite as safe/easy though but since boot.ini is a simple text file, you can certainly use notepad and make the changes.
[boot loader]
timeout=5
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Normal" /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Safe Mode" /fastdetect /safeboot /sos /bootlog

 

Well, when i looked up Safe Mode on my comp, it said go to Shut Down and select it. But I have no option 'Shut Down' under the start menu! Just Turn Off Computer and Log off

I have no clue what to do in Notepad....If it isn't too safe I don't want to mess with it

 

Another Double post, i know.

Yea, i got into it.

I will try your method now

 

Good luck and let us know how it works out.

 

Well, i did it. So far so good. Thanks a ton guys.

I might have some more problems int he future since i don't know very much about the actual computer system.

Thanks guys

 

It would be a good idea to also;
Open C:\Temp if present, select all and delete.
Open C:\Windows\Temp, select all and delete.
Open C:\Documents and settings\username\Local Settings\temp, select all and delete. Do this for all usernames.
Open C:\Windows\Prefetch, select all and delete.
Open control panel. If using Sun Java there will be an icon for Java Plug-in (when using classic view....if using category view, click other control panel options in the left pane under 'see also'). Open the plug-in and click the cache tab, then clear. You should also click the about tab and check the version. Currently at 1.4.2_06 If out of date, visit the Sun Java website to download the latest.
Open My Computer, right click Local disk C: and choose properties, then disk cleanup. Check all boxes except compress old files and OK.

Don't be surprised if you get a temp file or two that cannot be deleted. They are sometimes in use. A great app to use for those is Move-on-Boot. It will add a new right click option for files, to delete on next boot. Select this option for any stubborn files and then reboot.

Have you visited Windows Update and installed all of the latest security (critical) updates?

Are you able to access the system configuration utility yet (msconfig)?

 

AHHH! Dam* it. The Stuff came back

 

Please post a HijackThis log. Make sure you are using the current version.

HijackThis.exe

 

Ok. Though last time, i did what they said and it didnt work.


Also, my comp is really slow know that i deleted that stuff
-----
Logfile of HijackThis v1.98.2
Scan saved at 12:30:07 PM, on 10/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\ehome\ehRec.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EzButton\CplBTQ00.EXE
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Bobby Maclennan\My Documents\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
O4 - HKLM\..\Run: [CplBTQ00] C:\Program Files\EzButton\CplBTQ00.EXE
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [query] C:\WINDOWS\system32\query.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28177.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab28578.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab28578.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab
O21 - SSODL: Trayz - {F5B7D0BE-5f02-4211-96DB-386DFA244900} - (no file)
------

 

Double, I know

Well, I updated windows with an updated. Service pack 2. However, everything has like...changed. Plus, my computer know is jsut waaaaaaaaaay slow.

Windows messenger took over msn mesenger and signs me in automatically. I'd like that not to happen again

I don't like this update....possible to remove?

 

Scan again with HijackThis and place a check next to the following entries. Close ALL other windows and click fix.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [query] C:\WINDOWS\system32\query.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O21 - SSODL: Trayz - {F5B7D0BE-5f02-4211-96DB-386DFA244900} - (no file)
------

Reboot to safe mode, open CWShredder and click fix. Again, empty all temps and TIFs, then recycle bin. Reboot back into Windows.

Information below about this process, running on your machine, taken from answersthatwork.com. C:\WINDOWS\System32\nvsvc32.exe

NVIDIA Driver Helper Service which gets installed under Windows NT4/2000/XP/2003 by the NVIDIA drivers for some of their graphics cards (or graphics cards based on an NVIDIA chipset). We do not at this stage know what this process does except consume memory ! And we also have no idea as to what a "Driver Helper Service" is supposed to do !!

Recommendation :
This service is often responsible for various glitches, from significant shutdown delays to excessive memory usage. Disabling it, however, does not result in our experience in any ill-effect in regards to the proper operation of your NVIDIA or NVIDIA chipset graphics card, so we recommend that you definitely set the Startup Mode of this service to Disabled. You can do this by going to start>run, type services.msc, hit enter. Locate the service in the list and right click>properties. Stop the service, then disable, apply and OK out.

Can you check this file out, C:\WINDOWS\system32\query.exe, and give some info about it's properties?

You can end process on msmsgs.exe in task manager, then paste the following command into the run dialog box to remove Windows Messenger from your system.

RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove

Yes, if you chose to archive when installing SP2, you can uninstall it in add/remove programs, but I recommend not to. Some important security patches were applied with it, which will help to protect your computer from known vulnerabilities. There were a couple more critical updates after SP2 also. Might check back with WU to see that you have gotten all available.

Surf around for a couple of hours and then create and post a new HJT log, along with any comments. Would also like to know details as to why you think you have a CWS infection (what exactly happens).

 

I will do that

I know I have CWS. Whenever sometihng changes (unauthorized), SPYSWEEPER alerts me with a pop up and I can restore it. Except sometimes it gets past, plus, it always comes back

The main 3

-CWS-AboutBlank
-CWS .sp.html
-CWSCoolWebSearch

Those are what it finds

I will post again once i get done with your proceedure

Also, my comp takes an extra 3-5 minutes to load, freezes more, and on the taskbar it keeps have these bubble things (I know, click away) that say things. I thought that meant they were programs, so is that why it could be slow?

I'm kinda afraid to open Photoshop now since it is so big and my comp is soooo slow and freezes. Hopefully your way will help

 

20 minutes in, no ***** ups so far. They usually happen after reboots, so we'll se tomorrow

Got that file check on Query.EXE

http://img83.exs.cx/img83/4562/query.jpg

 

I was more interested in the info on the version tab........company, version #, etc.

Are you using any type of registry restore/protection feature, such as Spybot's TeaTimer, that may be putting the entries back in?

A bit more info if you can, on the task bar popups.