Worms-Cannot Connect to Internet

I started with trying to remove some of these manually following indmusic's advice. I found a lot of those files using add/remove. My machine crashed trying to remove one and now Internet Explorer is opening on it's own again with pop-up ads.

So I started on Zander's advice of using as-aware to try to remove some - now I'm back to where I was before - no connection (as he suspected could happen). It mentioned the LSP file the indmusic warned about. I will go back to ad-aware and restore then try to download the LSP fix.

Does this sound like the way to go?

Thanks,

Yevri

 

I guess I'd give that a try. Download LSP Fix and then run Adaware. After running Adaware use LSP fix to fix you connection. You could also try running Spybot before Adaware and see if it can take care of it. In either case I'd get LSP Fix downloaded first. It would be a good idea to download CWShredder as indmusic said. You can get it here. http://www.merijn.org/downloads.html

 

I downloaded LSP Fix and CWShredder. Then I ran Ad-Aware again and it said it quarantined a bunch, but I still had a bunch of pop-ups in IE. Then I ran SpyBot and it got a bunch and ran LSP. I also downloaded AVG's virus protection - it got some and said there was one it couldn't remove.

I still was getting a lot of pop-ups in IE. I tried installing Google Toolbar again and even though I got no errors, it never installed in IE.

Then I downloaded and installed ZoneAlarm Firewall. I am only getting one pop-up in IE now - as soon as I open IE a weatherbug thing or special offer pops up. I close it and all seems fine.

When no programs are open except ZoneAlarm and I do a ctrl alt del, it shows:

ZoneAlarm
Wupdater
Apropos
AVgcc32
Em_exec
Dw
Rundll
Avgserv9
Nprotect
Autoupdate

What else should I try? Should I still run HijackThis and post the log here?

Thanks,

Yevri

 

Wupdater
This is most likely related to the incredifind thing listed in your hijack this log. Gohere to find out what it is and how to get rid of it.

Apropos
This is another thing you want to get rid of. It's the source of at least some of your popups. Get the scoop on it here.

Dw
This can be unchecked in msconfig. It's something that's definitly not necessary. This is what Pacs-Portal has to say about it.
DownloadWare - executes arbitrary code from advertisers and not considered to be adware but is a security risk (see here). If a network connection is available it will connect to its servers, which can direct it to download and install software from advertisers. Installed along with programs such as MovieNetworks, Medialoads and PAgent
This is a direct to the list where this info comes from.
http://www.sysinfo.org/startuplist.php?filter=&count=100&type=

The rest appear to be ok. Nprotect is your norton protected recycle bin, the two avg ones are antivirus related.
Em_exec is part of the drivers for a logitech mouse or trackball. It provides advanced features for both. If you don't use them you can disable it in msconfig. If you do disable it and you miss something in the mouse functions, re-enable it in msconfig and it'll load the next time you restart your computer.

Since you've installed Zone Alarm I thought I should mention this. When an app asks for internet access, pay attention to what it is. Most are obvious, IE, OE, etc. But, if you see something requesting access and you don't know what it is, it might be best to deny it until you find out. You can always ask here. Also, pay attention to what it's asking for. If it's asking for server rights you want to know for sure that it's ok. Most apps don't require it, although there are some that do. Getright is an example of one that needs to have it. MSN Messenger and Windows Messenger will ask for server rights. I don't use them very often and to be honest I don't remember if they work without it or not. If you deny an app server rights, and it won't work, all you need to do is close the app and restart it. ZA will prompt you again as long as you didn't check the box next to the "remember this answer" thing. Also, you can always ask here.

As for the virus AVG found but couldn't clean, it may be that one of the programs mentioned above is considered a virus by AVG and the program was in use by windows so it couldn't be cleaned. Once you get them cleaned up, I'd run AVG again and if it still finds it, pay attention to the name of it and post it here. You didn't happen to catch it the first time around, did you?

One more thing. Don't be surprised if some of the software you've downloaded quits working after doing all of this. It's part of the bargain. You get free software and they get to hammer you with ads. If something does quit working, I'd find something else. There's almost always something available that will do the same thing without all the nastys. You can always ask here, or, a good place to find free software without all the junk is in the alt.comp.freeware newsgroup. They don't put up with all that stuff there and if somebody does post an answer that involvse this sort of thing, somebody will be quick to point it out. You can browse the group looking for what you want or you can post a question yourself. Just point your newsreader at it. If you don't know how to do that you can also get access to it in the Google groups. Here's a direct link to the group at google.
alt.comp.freeware

After you get all of your cleaning done, run hijack this again and post the results here. If you have any troubles removing things post back and I or somebody else may be able to help you. Good Luck!

 

Thanks for the advice, Zander. I am only getting one pop-up at a time now, when I'm in IE, not Netscape - when I launch and when I switch URLs, it will auto-pop an ad. This is a big improvement.

ZoneAlarm has stopped a dozen attempts to connect to the internet.

I've followed the links in your last post and followed their directions. While in regedit, I found a bunch of files that were named things I knew were worms - so I deleted all of them. Now when I do ctrl alt del I only get:

ZoneAlarm
Avgcc32
Apropos
Em_exec
Rundll
Avgserv9

So I think Apropos is the only one left. I followed the directions from and.doxdesk.com, but the files it said to add/remove weren't there and the files it said should be in the regedit weren't there. I looked for each two times and then did searches on each but couldn't find them. Not sure what's happening there.

Also, is Rundll a virus/worm or something I need? I will post HijackThis soon whether I resolve Apropos or not.

Thanks,

Yevri

 

I went to and.doxdesk.com using IE (instead of netscape) and it said that my browser was infected with Favoriteman/EMesX, IGetNet/ClearSearch and ShopAtHomeSelect. I thought I had gotten rid of these and I looked for some of the files it said I should delete, but couldn't find them.

By the way, the virus that AVG found was backdoor.NetBus in a file on my desktop that I had downloaded. I deleted it and now it isn't finding any viruses.

Yevri

 

Is it possible that the files you can't find are hidden files? Do you have windows set to show all files? Open any explorer window and click tools>folder options and then click on the view tab. Make sure the line that says show hidden files and folders is ticked. If not, tick the line and then see if you can find the files you're looking for.

 

Thanks again, Zander. You were right. I didn't even think about hidden files not being checked. I will go back in and look for them.

In the meantime, I just ran HijackThis again and it found a bunch of those files and deleted them. Now I am not getting any pop-ups (so far) and the site and.doxdesk.com says that IE is infected with only one parasite now: ShoppingAtHome...

Here is the log from HiJackThis before I said to fix them:

Logfile of HijackThis v1.97.7
Scan saved at 8:14:47 PM, on 1/28/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\COMPAQ\EASY ACCESS KEYBOARD\MEDIACTR.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\APROPOSCLIENT\APROPOS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://sidebar.smarter.com/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.smarter.com/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smarter.com/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.smarter.com/index.php
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD1.DLL
O2 - BHO: (no name) - {7DD896A9-7AEB-430F-955B-CD125604FDCB} - (no file)
O2 - BHO: (no name) - {FAC6E0E1-5D45-4907-BC00-302D702DCC73} - C:\WINDOWS\SYSTEM\cpr.dll
O2 - BHO: (no name) - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\ADROAR.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\PROGRAM FILES\APROPOSCLIENT\APROPOSPLUGIN.DLL
O2 - BHO: (no name) - {000000DA-0786-4633-87C6-1AA7A4429EF1} - C:\WINDOWS\SYSTEM\EMESX.DLL
O2 - BHO: (no name) - {000000F1-34E3-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\FONE.DLL
O2 - BHO: (no name) - {6085FB5B-C281-4B9C-8E5D-D2792EA30D2F} - (no file)
O2 - BHO: Clear Search - {947e6d5a-4b9f-4cf4-91b3-562ca8d03313} - C:\PROGRAM FILES\CLEARSEARCH\IE_CLRSCH.DLL
O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\ADROAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [EASY ACCESS KEYBOARD] C:\Program Files\Compaq\Easy Access Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [AdRoarUpdate] C:\WINDOWS\ARUpdate.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Browser Pal Toolbar (HKLM)
O16 - DPF: {8C28EFD7-767B-11D1-8400-000000000000} - http://reportflyr2.navigant.com/components/Brio.Insight.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38014.3252083333
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://owaeast.dcma.mil/tsweb/EAST/msrdp.cab

Here it is after I fixed them:

Logfile of HijackThis v1.97.7
Scan saved at 8:30:02 PM, on 1/28/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\COMPAQ\EASY ACCESS KEYBOARD\MEDIACTR.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\APROPOSCLIENT\APROPOS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

O4 - HKLM\..\Run: [EASY ACCESS KEYBOARD] C:\Program Files\Compaq\Easy Access Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

I didn't check these because I wasn't sure. Which of these should I have it fix?

Thanks,

Yevri

 

I just followed the directions to add/remove ShopAtHomeAgent, but it won't allow me to. Even though I've checked to view hidden files now, I still can't find any for Sahagent, but and.doxdesk.com says I still have it.

What should I do?

Thanks,

Yevri

 

LOL, I started reading your hijack this log and didn't realize at first that there was a before and after. I was reading the before part and didn't realize it. After all you've done, I was beginning to wonder what kind of beast you had here. When I got down the list far enough and saw the "after" part I had to let out a sigh of relief (and wipe the sweat off my brow). Except for the APROPOS.EXE thing it all looks pretty good. If you can beat that I'd say you're just about home free. There is one other thing you might want to get rid of. HPZSTATX.EXE is part of your HP printer driver. I've come across this before and have never been able to find just exactly what it's for. The general consensus seems to be that it's unnecessary. I see a lot of references to it being a resource and memory hog. Can't say first hand however. If you want to make a test run without it, do a ctrl>alt>delete and end task on it. Then find the file in windows explorer and rename it. You can always rename it back. If you can't do it this way you could boot to safe mode and rename it from there. This ones your call. It's just something I've seen in the past and I did a quick search and still find pretty much the same stuff I remember from before. Most say to delete it, but I think I'd just rename it (for a while at least).

I see you got rid of your google toolbar. After you get this all done you might try reinstalling it if you want. Don't know what I'd do without mine. If after you install it, it doesn't show up in view>toolbars take note to see if there's any duplicates there. I know when I had win98 there was a bug of some sort that made it show up as a duplicate of one of the others. I don't know if it was a bug caused by IE, windows or the toolbar itself but I guess that doesn't really matter. On mine, I had two radio buttons. One opened the radio toolbar and the other opened the google toolbar. Just thought I'd mention this as you said earlier that you installed the google toolbar but it didn't seem to work. I thought maybe this was a possiblility.

 

Sorry about the before and after. I bet that was confusing. I actually just did the hijackthis right before I posted that message, so it was a bit odd to me too that I still had all that on there after all I had done to get rid of the junk.

I like the google toolbar too. I just deleted it because it wouldn't install on IE anyway and I saw that there were indeed a few versions/copies of it. So I figured I'd delete it for now and install again later.

Apropos seems to be gone now, but ShopAtHomeSelect (SahAgent) is hanging in there. When I try to add/remove, it says "SahAgent is shutdown, Un-install will be completed on System reboot. "

But it doesn't go away. I'm now trying to delete it manually.

Now: When I tried to delete manually, the files weren't where and.doxdesk.com said they'd be - and I checked for hidden files. So I figured that it could be it can't uninstall because some files have been deleted already - the site also said "You can also delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\VGroup to clean up if you like. " SO I went into there and found a directory called sahAgent with tons of files in it. I deleted the directory. Then I went into add/remove and it seemed to be removing it - I got a progress bar that was moving and then wam! It locked up my machine.

I just rebooted (after pulling the plug!) and it came back up fine. I connected to and.doxdesk.com and it said it couldn't detect any parasites. How cool is that?! I am cautiously optimistic - I thought I was out of the woods a number of times already. But it's looking good. Hopefully I can stay on top of it now.

Thanks for all your help. I've really learned a lot about this stuff. Way more than I ever wanted to know. A lot of lost productivity - I'm sure there are stats on this, but I wonder how much time is wasted on pop-ups and trying to stop hijackers.

Anyway, thanks again, Zander!

I'll post again if/when more happens in regard to this. And I will send people to this site!

Yevri

 

Glad to hear you finally slayed the dragon (hopefully anyway). It can get quite challenging. FWIW, I would recommend that when you download software from the net to do just a wee bit of searching to see whether it contains adware or not. It can save countless headaches. I myself think that some of them border on being viruses. It shouldn't be that hard to uninstall software. I've been doing this (checking out potential downloads) for a long time now and I can't remember the last time Adaware or Spybot found anything on my system other than the usual tracking cookies you get while surfing the net. It's well worth a few minutes of my time to check it out. Good Luck and I sure hope it's over for you.