Hijacked! [HJT Log]

Billy the Kid - 06-09-22 3:22:05.20 Service Pack 1
ComboFix 06.09.20 - Running from: "C:\Documents and Settings\Billy the Kid\Desktop\spyware "
Command switches used ::

((((((((((((((((((((((((((((((( Files Created from 2006-08-22 to 2006-09-22 ))))))))))))))))))))))))))))))))))


2006-09-22 03:20 127,208 --a------ C:\WINDOWS\system32\mucltui.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-22 03:11 -------- d-------- C:\Program Files\hijackthis
2006-08-29 19:43 135168 --a------ C:\WINDOWS\system32\swreg.exe
2006-07-24 23:18 -------- d-------- C:\Program Files\QuickTime
2006-07-24 23:18 -------- d-------- C:\Program Files\Common Files
2006-07-24 20:39 -------- d-------- C:\Program Files\Internet Explorer
2006-07-24 20:37 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-07-24 20:34 -------- d-------- C:\Program Files\Classic PhoneTools
2006-07-24 16:50 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-07-24 16:49 -------- d-------- C:\Program Files\HighGrow
2006-07-24 16:49 -------- d-------- C:\Program Files\GetRight
2006-07-24 15:17 -------- d-------- C:\Program Files\Lavasoft
2006-07-24 12:24 -------- d-------- C:\Program Files\Inoculator
2006-07-23 16:07 -------- d-------- C:\Program Files\WindowsUpdate
2006-07-23 15:42 -------- d-------- C:\Documents and Settings\Billy the Kid\Application Data\Macromedia


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background "
"Yahoo! Pager "= "C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet "
"ctfmon.exe "= "C:\\WINDOWS\\System32\\ctfmon.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Disc Detector "= "C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe "
"WinFoxV2 "= "C:\\WINDOWS\\System32\\WF2K.EXE "
"WinFast2KLoadDefault "= "rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings "
"WinFast Schedule "= "C:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe "
"QuickTime Task "= "\ "C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime "
"nwiz "= "nwiz.exe /install "
"NvCplDaemon "= "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize "
"NeroCheck "= "C:\\WINDOWS\\System32\\NeroCheck.exe "
"Inoculator "= "C:\\Program Files\\Inoculator\\inoc.exe "
"HPDJ Taskbar Utility "= "C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb05.exe "
"FSW "= "C:\\Program Files\\FSW\\FSW.EXE "
"CARPService "= "carpserv.exe "
"CapFax "= "C:\\Program Files\\Classic PhoneTools\\CapFax.EXE "
"C-Media Mixer "= "Mixer.exe /startup "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonceex]
"Flag "=dword:00000002

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"RunNarrator "= "Narrator.exe "
"tscuninstall "=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"RunNarrator "= "Narrator.exe "
"tscuninstall "=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972} "=" "
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8} "= "ewido anti-spyware 4.0 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=hex:5f,00,00,00
"NoInstrumentation "=dword:00000000
"NoToolbarCustomize "=dword:00000000
"RestrictRun "=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"ClearRecentDocsOnExit "=dword:00000001
"NoRecentDocsHistory "=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder "= "{7849596a-48ea-486e-8937-a2a3009f31a9} "
"CDBurn "= "{fbeb8a05-beee-4442-804e-409d6c4515e9} "
"WebCheck "= "{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "
"SysTray "= "{35CEC8A3-2BE6-11D2-8773-92E220524153} "
"UPnPMonitor "= "{e57ce738-33e8-4c51-8354-bb4de9d215d1} "


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Symantec NetDetect.job

Completion time: Fri 09/22/2006 3:22:45.10
ComboFix.txt
ComboFix2.txt
ComboFix3.txt

 

Logfile of HijackThis v1.99.1
Scan saved at 3:23:43 AM, on 9/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\WINDOWS\System32\WF2K.EXE
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\ShareDLL\MediaDet.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by OptusNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar_en_2.0.95-big.dll
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\System32\WF2K.EXE
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Inoculator] C:\Program Files\Inoculator\inoc.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [FSW] C:\Program Files\FSW\FSW.EXE
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\windows\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.optusnet.com.au
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1153720701531
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1153724987734
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://D:\SuperCD\IntraLaunch.CAB
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?310
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VexiraAntivirus - Unknown owner - C:\Program Files\Vexira\VAGUARD.EXE (file missing)

 

Well all is good except this one folder does not want to go away:
C:\Program Files\WindowsUpdate<<<<---this one

Manually delete this one if possible please.

Then you're cleaned up.

Any more troubles at this point in time? Please let me know.

 

Thanks again for all your help and professionalism.
I have completed all the steps and am just in the process of updating the computer through windows update to SP2. I will see how things are after that but at this stage there is only two minor niggles.

Internet explorer has a 'YES' box that is present in the top right side of the screen....it is an animated 'YES' that is always there....does this mean something has got in and altered IE? I am hoping that the new version of IE installed under SP2 will circumvent this issue.
The runtime errors seem to be popping up.....could that be malware related?

Cheers
Tony.

 

I'd get all updated, and see if any of the files contained within those update fix the error.

Now for that 'yes' box, can I get a screen shot of that please.

And lets get an uninstall list from HJT to see if perhaps there is a rogue toolbar or something of that sort that didn't show up.

Start HijackThis

• Click on the Config button
• Click on the Misc Tools button
• Click on the Open Uninstall Manager button
• Then click on the Save list button and specify where you would like to save this file.
• When you press Save button a notepad will open with the contents of that file.
• Copy and paste the contents of that notepad back into this thread for me to view.

 

Thanks...here is that log as requested.

SP2 took ages to install but has completed now. When it started up it told me that windows firewall was not able to be installed/configured or opened.

The 'YES' is still there....I will post a screenshot on a seperate posting.


Ad-aware 6 Personal
Adobe Acrobat 5.0
AVG Free Edition
Bios Wizard
Classic PhoneTools
Digital Image Recovery 1.47
HijackThis 1.99.1
hp deskjet 3420 series (Remove only)
HP Photo and Imaging 1.0 - Scanjet 2300c Series
HP Photo and Imaging 1.1 - Photosmart Cameras
iolo technologies' System Mechanic
Leadtek WinFastDVD
Macromedia Flash Player 8
Media Library Management Wizard
Microsoft Office Professional Edition 2003
Movie Maker Background Music Files
Movie Maker Sound Effects
Movie Maker Title Images
Nero - Burning Rom
NeroMediaPlayer
NVIDIA WDM Drivers
NVIDIA Windows 2000/XP Display Drivers
OptusNet
PCI Audio Applications
PCI Audio Driver
Personal License Update Wizard for Windows Media Player
PIXELA ImageMixer
PowerDVD
QuickTime
RealPlayer Basic
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Softk56 Data Fax Voice Speakerphone CARP
SolSuite
Ulead VideoStudio 6 SE DVD
Update for Windows XP (KB898461)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Windows Installer 3.1 (KB893803)
Windows Media Bonus Pack for Windows XP
Windows Media Player Playlist Import to Excel Wizard
Windows Media Player Skin Importer
Windows Media Player Tray Control
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinFast TV USB
WinFast(R) Display Driver
WinFast(R) TV2000 XP / VC100 XP(Application)
WinFast(R) TV2000 XP / VC100 XP(WDM Driver)
WinZip
Zoom Player (remove only)

 

Hmmm.....not sure that I have the ability to post attachments. How would you like me to post the picture?

Tony.

 

Upload it to photobucket:
http://photobucket.com/

 

Screenshot as requested.
http://i106.photobucket.com/albums/m252/QuirkyMac/screenshot.jpg

 

Ah, now I know what it is, tho I had to share the image with a fellow analyst. That is a replacement for the IE spinning globe which is activated when pages load. It is also almost unheard of that an infection would do this, is it possible that you changed it, or someone else who has access to the PC?

You can change it manually:
http://www.g4tv.com/techtvvault/fea...Change_Internet_Explorers_Spinning_Globe.html

Or use this tool:
http://www.ieinfosite.co.uk/tip_view.asp?id=133

 

Thanks for that and well done figuring it out. The computer is my neighbours if it is doing no harm and is not Malware etc....then I might just leave them with it.

From me and the neighbours, thank you very much for all your efforts.

You can close this thread if that helps tidy things up.

Tony.

 

Glad we could be of assistance.

Due to resolution this topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.