W2000 Log

Logfile of HijackThis v1.98.2
Scan saved at 6:15:16 PM, on 10/31/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\desk95.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Other Program Files\ZoneAlarm\zlclient.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\system32\svhost.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINNT\system32\ntvdm.exe
C:\02-30 files\COMPUTER CLEANUP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\jrusf.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\jrusf.dll/sp.html#37794
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\jrusf.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\jrusf.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\jrusf.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\jrusf.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {E1179308-4CA1-094A-3866-F78B9B7E7FDD} - C:\WINNT\system32\crkh32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] desk95.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Other Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Microsoft System NT] svhost.exe
O4 - HKLM\..\RunServices: [Microsoft System NT] svhost.exe
O4 - HKCU\..\Run: [SFP] C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s
O4 - HKCU\..\Run: [Microsoft System NT] svhost.exe
O4 - Startup: OCRAWARE.lnk = C:\OPLIMIT\OCRAWARE.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

Hi goathead
there is no problem when you include all then we know it is all, if it is edited, then there is always a question of whether something important was edited out.

Looks like you found the culprit! Another added service so unfortunately all those steps have to be repeated again.


Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer closed throughout as opening it will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Please continue with the next step and if you run into any problems with the current one, just keep going through the list step by step. Just be sure to let us know what the problem was when you finally reply.


Step#1:


1. If you deleted About Buster, Please download About:Buster from here: http://tools.zerosrealm.com/AboutBuster.zip.
.

2. Once it is downloaded extract it to c:\aboutbuster. Do NOT use it yet


Step#2:

Another program to download is Registrar Lite for use later: Please download Registrar Lite and install it to C:\Program Files\RegLite\ . This is a registry editor that is very easy to use.


Step#3:



Please disconnect from the Internet and unplug your modem for the duration of this fix

1. Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE

2. Click on start > control panel > administrative programs > services. Look for a service called Network Security Service (NSS). Double click on that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.


Step#4:

Press control-alt-delete to get into the task manager and end the follow processes if they exist:

C:\WINNT\system32\svhost.exe <— there may be more than one but make sure to check the spelling because svchost.exe is a legitimate system file.


Step#5:


I now need you to delete the following files:

C:\WINNT\system32\svhost.exe <–check spelling - kill all you find with this spelling
c:\winnt\discover.exe:kpxnk /s
C:\WINNT\jrusf.dll
C:\WINNT\system32\crkh32.dll
C:\WINNT\svhost.exe <— possible location


If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.


Step#6:


Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\jrusf.dll/sp.html#37794

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\jrusf.dll/sp.html#37794

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\jrusf.dll/sp.html#37794

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\jrusf.dll/sp.html#37794

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\jrusf.dll/sp.html#37794

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\jrusf.dll/sp.html#37794

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {E1179308-4CA1-094A-3866-F78B9B7E7FDD} - C:\WINNT\system32\crkh32.dll

O4 - HKLM\..\Run: [Microsoft System NT] svhost.exe

O4 - HKLM\..\RunServices: [Microsoft System NT] svhost.exe

O4 - HKCU\..\Run: [Microsoft System NT] svhost.exe



Step#7:


In the next step we are going to remove a service that gets installed by this malware.

1. Open Registrar Lite and run it.

2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):

1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)


3. Copy and paste the bold text below into the address bar of Reglite:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\O?’ŽrtñåȲ$Ó

3. Click Go

4. If O?’ŽrtñåȲ$Ó exists it will be highlighted in the left pane , right click on it and choose delete from the menu.


5. Copy and Paste the bold text below into the address bar of Registrar Lite:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_O?’ŽrtñåȲ$Ó

6. Click Go

7. If LEGACY_O?’ŽrtñåȲ$Ó exists then right click on it and choose delete from the menu.

8. If you have trouble deleting a key. Then click once on the key name to highlight it and on the top menu choose Security, then Edit Permissions. Then make sure you are an Administrator and give yourself Full Control of that key. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.

9. If you have had to change the permissions on the keys in Registrar Lite then they will have to be returned to the way they were . To do this please navigate to C:\ProgramFiles\Registrar Lite (Reglite) and double-click on Winkey.reg. It will ask if you want to merge this file with the registry, say Yes. Then double-click on Winkey.hiv and merge this file with the Registry. You have now returned the permissions to the way they were.



Step#8:

This is the step where we will use About:Buster that you had downloaded previously.

Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so. Post the log file in your next reply

When it has completed move on to step 9.


Step#9:

Copy the contents of the Quote Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
and Save it on the desktop

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.


Step#10:

1.Reboot your computer back to normal mode and Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.

2. Post both your log from About Buster and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.here in this thread with any questions or problems that you have run into. There will be necessary files that it has deleted that will need to be replaced. There are still a few steps that are necessary to clear out all of the malware.

Good Luck!

Hey dgosling, thanks for your patience. I thought I'd be a little more detailed than before. The logfiles are in steps 8 and 10 below. Thanks goathead Step#1: OK Step#2: OK Step#3: 1. OK 2. [snip]…write down the name and path of the file listed in the Path to executable field. Service name - O?’ŽrtñåȲ$Ó Path to executable - C:\WINNT\discover.exe:kpxnk /s Error: A genereal internal error occured. (I got this msg twice) However, I was able to disable the service. Step#4: C:\WINNT\system32\svhost.exe - file was not found, so it was not deleted. Step#5: C:\WINNT\system32\svhost.exe DELETED c:\winnt\discover.exe:kpxnk /s NOT FOUND, but I DID delete c:\winnt\discover.exe C:\WINNT\jrusf.dll NOT FOUND C:\WINNT\system32\crkh32.dll DELETED C:\WINNT\svhost.exe <— possible location NOT FOUND I DID find another file, C:\WINNT\System32\spool\drivers\svhost.exe. I DELETED it. Additionaly, I found but did NOT delete the following files: (not on your list) C:\I386\DISCOVER.EX_ C:\WINNT\System32\dllcache\discover.exe Step#6: In addition to ALL the registry keys you listed, I also deleted one that was identical to one of your R1 keys except it said "search bar" instead of "search page". Step#7: 1. OK 2. OK 3. OK 4. If O?’ŽrtñåȲ$Ó exists it will be highlighted in the left pane , right click on it and choose delete from the menu. DELETED 5. OK 6. OK 7. If LEGACY_O?’ŽrtñåȲ$Ó exists then right click on it and choose delete from the menu. NONE FOUND However, I found two additional instances containing the string O?’ŽrtñåȲ$Ó by searching in the regedit dialog, and I DELETED them. 8. OK 9. OK Step#8: – Scan 1 ————————— About:Buster Version 3.0 Reference List : 15 No ADS found on system Removed! : C:\WINNT\apptz.dll Removed! : C:\WINNT\d3yt32.exe Removed! : C:\WINNT\mfcie.exe Removed! : C:\WINNT\system32\appab32.exe Removed! : C:\WINNT\system32\crhr32.exe Attempted Clean Of Temp folder. Removed Uninstall Key (HSA) Removed Uninstall Key (SE) Removed Uninstall Key (SW) Pages Reset… Done! – Scan 2 ————————— About:Buster Version 3.0 Reference List : 15 No ADS found on system Attempted Clean Of Temp folder. Pages Reset… Done! Step#9: OK Step#10: Logfile of HijackThis v1.98.2 Scan saved at 8:42:52 PM, on 11/3/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\WINNT\System32\svchost.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\atiptaxx.exe C:\WINNT\system32\desk95.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\Other Program Files\ZoneAlarm\zlclient.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\WINNT\system32\ntvdm.exe C:\02-30 files\COMPUTER CLEANUP\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [HydraVisionDesktopManager] desk95.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Other Program Files\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKCU\..\Run: [SFP] C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s O4 - Startup: OCRAWARE.lnk = C:\OPLIMIT\OCRAWARE.EXE O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll