27 replies to this topic

[LDTate]

Then download this program.

http://downloads.sub.../DllCompare.exe

Open the program and click the "Run Locate.com" button.
Then click the "Compare" button (this will take a few minutes)
When it finishes click the "Make Log...." button.

Post the dll compare log to this thread.

[proton777]

The program defaulted to the System32 Folder. Here is the scan: * DLLCompare Log version() Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\ntibun4.dll Sat Aug 13 2005 9:47:06p ...HR 1,024 1.00 K C:\WINDOWS\SYSTEM32\nticdmk7.dll Sun Jul 31 2005 4:02:44p ...HR 1,024 1.00 K C:\WINDOWS\SYSTEM32\ntidbd32.dll Sat Aug 13 2005 9:55:42p ...HR 1,024 1.00 K C:\WINDOWS\SYSTEM32\ntifcd3.dll Sun Jul 31 2005 4:02:44p ...HR 1,024 1.00 K C:\WINDOWS\SYSTEM32\ntimpeg2.dll Sun Jul 31 2005 4:02:44p ...HR 1,024 1.00 K ________________________________________________ 2,597 items found: 2,597 files (5 H/S), 0 directories. Total of file sizes: 560,248,763 bytes 534.29 M Administrator Account = True --------------------End log---------------------

[LDTate]

Those all look OK.

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[LDTate]

Those are both OK as well.

http://www.dslreports.com/faq/5559
Winlogon.exe Windows log on utility Accepts user passwords Always Permit


Norton Anti-Virus
LUcallback is part of LiveUpdate.

[proton777]

OK, here's the latest. I did everything you said. About the Winlogon.exe, I read about trojans it said they can attach themselves and rename their file name to a seemingly legitimate one. It's possible that it's a valid file trying to access the network, but my firewall never warned me before. I just got another popup from the firewall saying IEXPLORE.EXE is trying to access the network and was blocked, even though my internet connection is working. I never saw that either, until the virus.

Here are the logs:

Logfile of HijackThis v1.99.1
Scan saved at 2:17:28 PM, on 2/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Documents and Settings\tp3\Desktop\Applications\SpyWare\Hijack This\HijackThis.exe
C:\Program Files\America Online 8.0\aol.exe
C:\Program Files\America Online 8.0\waol.exe
C:\Program Files\America Online 8.0\aolwbspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://amigos.inbox....hp?language=en"); (C:\Documents and Settings\tp3\Application Data\Mozilla\Profiles\default\neeag01w.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\tp3\Application Data\Mozilla\Profiles\default\neeag01w.slt\prefs.js)
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Creative Launcher] C:\Program Files\Creative\Launcher\CTLauncher.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - Startup: desktop(2).ini
O4 - Startup: desktop(3).ini
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: desktop(2).ini
O4 - Global Startup: desktop(3).ini
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_07\bin\npjpi141_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_07\bin\npjpi141_07.dll
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec....trl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec....trl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...rl/LSSupCtl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122280642390
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


There's a new O2) there

And the Spy Sweeper log:


********
1:09 PM: | Start of Session, Saturday, February 25, 2006 |
1:09 PM: Spy Sweeper started
1:09 PM: Sweep initiated using definitions version 621
1:09 PM: Found Trojan Horse: trojan-downloader-zlob
1:09 PM: HKLM\software\microsoft\windows\currentversion\policies\explorer\run\ || wininet.dll (ID = 1052561)
1:09 PM: dfrgsrv.exe (ID = 1052561)
1:09 PM: Starting Memory Sweep
1:11 PM: Memory Sweep Complete, Elapsed Time: 00:02:13
1:11 PM: Starting Registry Sweep
1:11 PM: HKLM\software\microsoft\windows\currentversion\policies\explorer\run\ || wininet.dll (ID = 797671)
1:11 PM: Found Trojan Horse: trojan agent winlogonhook
1:11 PM: HKLM\software\microsoft\mssmgr\ (9 subtraces) (ID = 937101)
1:12 PM: Registry Sweep Complete, Elapsed Time:00:00:18
1:12 PM: Starting Cookie Sweep
1:12 PM: Found Spy Cookie: overture cookie
1:12 PM: guest@data4.perf.overture[1].txt (ID = 3106)
1:12 PM: Found Spy Cookie: go.com cookie
1:12 PM: guest@espn.go[2].txt (ID = 2729)
1:12 PM: Found Spy Cookie: 2o7.net cookie
1:12 PM: guest@msnportal.112.2o7[1].txt (ID = 1958)
1:12 PM: guest@rsi.espn.go[1].txt (ID = 2729)
1:12 PM: guest@sports.espn.go[2].txt (ID = 2729)
1:12 PM: tp3@2o7[1].txt (ID = 1957)
1:12 PM: Found Spy Cookie: atwola cookie
1:12 PM: tp3@atwola[1].txt (ID = 2255)
1:12 PM: Found Spy Cookie: centrport net cookie
1:12 PM: tp3@centrport[1].txt (ID = 2374)
1:12 PM: Found Spy Cookie: seeq cookie
1:12 PM: tp3@seeq[1].txt (ID = 3331)
1:12 PM: tp3@www48.seeq[1].txt (ID = 3332)
1:12 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
1:12 PM: Starting File Sweep
1:37 PM: File Sweep Complete, Elapsed Time: 00:25:02
1:37 PM: Full Sweep has completed. Elapsed time 00:27:38
1:37 PM: Traces Found: 23
1:44 PM: Removal process initiated
1:44 PM: Quarantining All Traces: trojan-downloader-zlob
1:44 PM: Quarantining All Traces: trojan agent winlogonhook
1:44 PM: Quarantining All Traces: 2o7.net cookie
1:44 PM: Quarantining All Traces: atwola cookie
1:44 PM: Quarantining All Traces: centrport net cookie
1:44 PM: Quarantining All Traces: go.com cookie
1:44 PM: Quarantining All Traces: overture cookie
1:44 PM: Quarantining All Traces: seeq cookie
1:44 PM: Removal process completed. Elapsed time 00:00:01
1:44 PM: | End of Session, Saturday, February 25, 2006 |
********

So, I can see remnants of the problems. DFRGSRV and MSSMGR were indeed part of the problem. And maybe Winlogonhook is related the the Winlogon.exe.

[LDTate]

Lets see if we can get rid of the desktp.ini issues too.

1. Click Start, and then click Run.
2. In the Open box, type msconfig, and then click OK.
3. Click the Startup tab.
4. Click to clear the check box beside any desktop entries in the Startup Item column that are listed as Common Startup in the Location column, and are also located in any of the following locations (as indicated in the Command column): • drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

5. Click OK to quit the System Configuration Utility.
6. Restart your computer and verify that the issue is resolved.

Run another Spysweeper scan I'd rather have spysweeper clean it without using regedit.

[proton777]

I did it an am back. There were 4 copies of desktop.ini in MSCONFIG. I unchecked the two as you described, then rebooted. Two remain and are showing up in HJT. The locations and names shown in MSCONFIG are: Desktop(2) Docs&Settings/All Users/Start Menu/Startup/Desktop(2).ini Desktop(3) Docs&Settings/All Users/Start Menu/Startup/Desktop(3).ini I unchecked the first two in MSCONFIG Then two more copies remain: Desktop(2) Docs&Settings/TP3/Start Menu/Programs/Startup/Desktop(2).ini Desktop(3) Docs&Settings/TP3/Start Menu/Programs/Startup/Desktop(3).ini I read your instructions a few times. It's not clear if I should have deleted all four of these or not. It looks like you are saying to only delete the ones in Common Startup IF they also exist in the other location.

[LDTate]

Do you have more then one user that logs in to this PC?

[proton777]

Yes, there is another user account and a Guest account.

[LDTate]

I would delete all except desktop.ini

[proton777]

Done. I think we can call it a day. With the exception of the rare firewall popups for winlogon.exe and iexplore.exe, we're looking good. They could be normal. I'll deal with removing all the duplicate files later. Thanks for your help. You are very patient and really know your stuff. I can only hope to gain enough patience and knowledge in the future to voluntarily help a stranger as you helped me today. Very much appreciated. Tony

[LDTate]

Great job

You're more then welcome.
Glad we were able to help

Peace be with you


http://forums.tomcoy...?showtopic=1421

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php