What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

To Daemon From Tgus08

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi Daemon followed your instructions ran a virus scan with Panda ran spybot got and ran adaware se and this is the new log. Thanks GusLogfile of HijackThis v1.98.2
Scan saved at 1:43:51 PM, on 11/29/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\devldr32.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\NavNT\vptray.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\Program Files\Free Surfer\fs20.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINNT\System32\NceB0i.exe
C:\WINNT\System32\BytOP.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Gus Butterfield\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bellsouth.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\Gus Butterfield\Application Data\Mozilla\Profiles\default\54eoqecx.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Gus Butterfield\Application Data\Mozilla\Profiles\default\54eoqecx.slt\prefs.js)
O2 - BHO: (no name) - {32AD680B-E21C-2AE6-D555-6C550A86793A} - C:\WINNT\system32\uvtrqbzs.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [freesurfer] C:\Program Files\Free Surfer\fs20.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Prein] C:\DOCUME~1\GUSBUT~1\LOCALS~1\Temp\app81.tmp
O4 - HKLM\..\Run: [5MWDQ@Z4E4P3RB] C:\WINNT\system32\Bwd0n.exe
O4 - HKLM\..\Run: [wqEZ.exe] C:\documents and settings\gus butterfield\local settings\temp\wqEZ.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [o42WM7En.exe] C:\documents and settings\gus butterfield\local settings\temp\o42WM7En.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: atlasbid - https://gw-r9.airline.compuserve.com/http:/…ic/atlasbid.cab
O16 - DPF: bea - https://gw-r4.airline.compuserve.com/http:/…tlasbid/bea.cab
O16 - DPF: CTCBridge UTS - http://localhost/juts/classi/jutsi.cab
O16 - DPF: swingall - https://gw-r4.airline.compuserve.com/http:/…id/swingall.cab
O16 - DPF: WebConnect Pro 5.1.7 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: WebConnect Pro 6.2.9 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: WebConnect Pro 6.3.2 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: WebConnect Pro 6.3.9 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
Post #2
When replying to your topic, please use the [external image: Posted Image] button NOT the [external image: Posted Image] button.

Click here to download the PeperFix tool, save it to your desktop, doubleclick on it, click 'Find and Fix' and reboot if prompted.

Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the red 'Delete File' button after pasting each one:

C:\documents and settings\gus butterfield\local settings\temp\app81.tmp
C:\documents and settings\gus butterfield\local settings\temp\wqEZ.exe
C:\documents and settings\gus butterfield\local settings\temp\o42WM7En.exe

Click 'Exit' when done.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

Then create a new folder called C:\HijackThis, extract the HijackThis.exe file from the zip file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong. Make sure that you have no other browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {32AD680B-E21C-2AE6-D555-6C550A86793A} - C:\WINNT\system32\uvtrqbzs.dll (file missing)
O4 - HKLM\..\Run: [Prein] C:\DOCUME~1\GUSBUT~1\LOCALS~1\Temp\app81.tmp
O4 - HKLM\..\Run: [5MWDQ@Z4E4P3RB] C:\WINNT\system32\Bwd0n.exe
O4 - HKLM\..\Run: [wqEZ.exe] C:\documents and settings\gus butterfield\local settings\temp\wqEZ.exe
O4 - HKLM\..\Run: [o42WM7En.exe] C:\documents and settings\gus butterfield\local settings\temp\o42WM7En.exe

Reboot when done. Using Windows Explorer, navigate to the !Submit folder on the C:\ drive and inside you will the files removed by TheKillbox - zip them up individually and send to this e-mail address including a link to this thread in the body of the email.

Rescan with HJT and post a new log for a final check over.
Post #3
Hi Daemon thanks for answering back. I travel a lot so it takes me a day or two to get back to you. Heres what I did. Downloaded peperfix clicked find and fix and rebooted. Had to manually push reset to shut down don't know if that affected it.Rebooted and installed killbox. unzipped and got to the full path of file to delete box and fianlly pasted th 1st of the three files. Got a message box no flie seems to exist. Downloaded missing files setup.exe and tried killbox again same message. Tried to create new folder on desktop called C:\Hijack this and it said cannot use \ : etc symbols See how inept I am. named it hijack this and put the shortcut there but it still always wants to unzip then tell me I'm running in a temp file etc but I finally get a scan log to notepad. Found all five files you had named and fixec checked them. Rebooted and it did a normal shutdown and restart. Heres the new log are we getting anywhere or shoud I dropkick this Dell into Hell? Thanks again for you patient tutelage. GusLogfile of HijackThis v1.98.2
Scan saved at 3:44:45 PM, on 12/6/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\devldr32.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\NavNT\vptray.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\Program Files\Free Surfer\fs20.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Gus Butterfield\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bellsouth.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\Gus Butterfield\Application Data\Mozilla\Profiles\default\54eoqecx.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Gus Butterfield\Application Data\Mozilla\Profiles\default\54eoqecx.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [freesurfer] C:\Program Files\Free Surfer\fs20.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Program Files\Free Surfer\FS20.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: atlasbid - https://gw-r9.airline.compuserve.com/http:/…ic/atlasbid.cab
O16 - DPF: bea - https://gw-r4.airline.compuserve.com/http:/…tlasbid/bea.cab
O16 - DPF: CTCBridge UTS - http://localhost/juts/classi/jutsi.cab
O16 - DPF: swingall - https://gw-r4.airline.compuserve.com/http:/…id/swingall.cab
O16 - DPF: WebConnect Pro 5.1.7 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: WebConnect Pro 6.2.9 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: WebConnect Pro 6.3.2 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: WebConnect Pro 6.3.9 - http://localhost:2080/WebConnectDU.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
Post #5
HI Daemon, Well believe it or not it is running faster although I don't think it is near optimum. Its a Dell with 128 mb running 2000 I would like to upgrade to xp but i know I need more ram. Unfortunately this thing has some special Rdr ram that is hard to find and $$. Would this thing run xp at 128 or should I get more ram no matter what? Also would appreciate your opinion on how to keep this machine clean. I ran lava soft it found a few things hijack was the only registry key it didn't like so that looked good but I also ran anoadware program its a free scan but you pay to clean, and it found a few more troubling items. kazaa has one in a hkey local machine reg key, trojan agent.bi dame place sandboxer abd p2p networking also in the registry. Then there is VX2/linkreplace that spysweep and adaware found bu seewper said its in memory and cant be removed. Noadware actually lists it three times. Ares is last on that list. Are any of these spyware scanner/removers worth paying for? They all seem to find some but not all the problems. Thanks in advance for any advice. Oh also what about a firewall I am using the free zone alarm but it is not as strong as the 15 day full trial version. Gus
Post #6 last edited
You're welcome - glad to help :D Stick to AdAware SE and Spybot. Also follow the recommendations in Tony's article here:

So how did I get infected in the first place?

Zone alarm is OK as a firewall.

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI