11 replies to this topic

[nena1974]

my pc at work is giving me trouble. we have a copany inTRAnet and when i go to our company directory if creates links to part words, for example: someones title is outcome analist and anal from analist will be underlined and in blue (like a link). If you point at it with your mouse the bottom shows Searchmiracle.com can anyone help with this, i want to try to solve this issue without having to call in the computer guys. By the way, i use the intranet, but don't go into any porn sites or anything like that. I use it to check email, ebay, amazon etc. if i go into program files, common files, there is a folder called elite toobar and each time i delete it, it comes right back, i think this is the problem any help is greatly appreciated

[Micah_6:8]

You've been "malwared". Post a Hijack This! log from the PC, and I'll take a peek at it.

[nena1974]

will do it tomorrow morning. thanks so much for such a quick response

[nena1974]

here is my hijackthis log, any help is greatly appreciated.

Logfile of HijackThis v1.98.2
Scan saved at 7:52:05 AM, on 12/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\r_server.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Scansoft\PaperPort\viperusb.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\w?nlogon.exe
C:\Documents and Settings\NMazon\Application Data\eura.exe
\Nmazon-xp\c$\Program Files\Microsoft Office97\Office\OSA.EXE
C:\Documents and Settings\NMazon\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll
O2 - BHO: BHO Class - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\ELITES~1\ELITES~1.DLL (file missing)
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvwje32.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [StrobePro] C:\Program Files\Scansoft\PaperPort\viperusb.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Ytdl] C:\WINDOWS\System32\w?nlogon.exe
O4 - HKCU\..\Run: [Sesd] C:\Documents and Settings\NMazon\Application Data\eura.exe
O4 - HKCU\..\Run: [BMUpdate] C:\WINDOWS\System32\BMUpdate.exe
O4 - Startup: Office Startup.lnk = Program Files\Microsoft Office97\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://206.161.125.1....chm::/open.exe
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.co...ysb_regular.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-downlo...tsInstaller.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = anixter.org
O17 - HKLM\Software\..\Telephony: DomainName = anixter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = anixter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = anixter.org

[Micah_6:8]

First, go to:

Start > Control Panel > Add/Remove Programs, and remove any if these found in there:

Elite Toolbar
ISTbar
SideFind

Reboot after each removal.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O2 - BHO: BHO Class - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\ELITES~1\ELITES~1.DLL (file missing)

O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvwje32.exe

O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe

O4 - HKCU\..\Run: [Ytdl] C:\WINDOWS\System32\w?nlogon.exe

O4 - HKCU\..\Run: [Sesd] C:\Documents and Settings\NMazon\Application Data\eura.exe

O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll (file missing)

O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://206.161.125.1....chm::/open.exe

O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-downlo...tsInstaller.cab

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\documents and settings\nmazon\application data\eura.exe <--- file

c:\program files\istsvc <--- FOLDER

C:\Program Files\SideFind <--- FOLDER

c:\windows\elitetoolbar <--- FOLDER

c:\windows\system32\kalvwje32.exe <--- file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

[nena1974]

I was able to do all except reboot in safemode. We have to log into our pc here at work and when i try to reboot in safemode, it doesnt recognize my password. is there a way to do this without having to reboot in safemode? Here is the most recent hijackthis log. Your help is greatly appreciated.

Logfile of HijackThis v1.98.2
Scan saved at 1:29:38 PM, on 12/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\r_server.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Scansoft\PaperPort\viperusb.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
\Nmazon-xp\c$\Program Files\Microsoft Office97\Office\OSA.EXE
C:\WINDOWS\system32\userinit.exe
C:\Documents and Settings\NMazon\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [StrobePro] C:\Program Files\Scansoft\PaperPort\viperusb.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvwje32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [BMUpdate] C:\WINDOWS\System32\BMUpdate.exe
O4 - Startup: Office Startup.lnk = Program Files\Microsoft Office97\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.co...ysb_regular.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = anixter.org
O17 - HKLM\Software\..\Telephony: DomainName = anixter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = anixter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = anixter.org

[Micah_6:8]

You got all the malware except one item.

Without access to "safe mode", we need to do this:

Download killbox from here

http://www.downloads...org/KillBox.zip

Then unzip it.

Close all windows and programs.

Run Killbox and paste the next line into the "Full Path of File to Delete" text box.

c:\windows\system32\kalvwje32.exe

Check the button to the left of "Delete on Reboot".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes".

After the reboot:

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvwje32.exe

Then click "Fix checked".

Reboot and post a new log file.


P.S. I answered the post in the other forum concerning your home PC.

[nena1974]

I want to thank you for all your help, your awesome here is my new hijack this log. FYI: The elite toolbar folder is still in windows folder, and I have ran the hijack this twice and checked 04-hklm\..\run\[kalvsys]c:\windows\system32\kalvwje32.exe still comes up on the log.

Logfile of HijackThis v1.98.2
Scan saved at 2:22:01 PM, on 12/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\r_server.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Scansoft\PaperPort\viperusb.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
\Nmazon-xp\c$\Program Files\Microsoft Office97\Office\OSA.EXE
C:\WINDOWS\system32\userinit.exe
C:\Documents and Settings\NMazon\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [StrobePro] C:\Program Files\Scansoft\PaperPort\viperusb.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvwje32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [BMUpdate] C:\WINDOWS\System32\BMUpdate.exe
O4 - Startup: Office Startup.lnk = Program Files\Microsoft Office97\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.co...ysb_regular.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = anixter.org
O17 - HKLM\Software\..\Telephony: DomainName = anixter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = anixter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = anixter.org

[Micah_6:8]

Download Service Filter

Extract it to it's own folder.

Click on ServiceFilter.vbs. If your antivirus pops up (like mine did), tell it to allow this script to run.

A text file called POST_THIS will be created in the same folder. Please post it's contents as a reply to this post

Download: Registry Search Tool (RegSrch.zip) [freeware]
http://billsway.com/vbspage/

Open the Registry Search tool (RegSrch.vbs) and enter: kalvwje32.exe and post the contents found. If your antivirus pops up (like mine did), tell it to allow this script to run.

[Micah_6:8]

OK... I thought of something simpler.

Before you do what I posted previously, please try this:

Push these three keys at the same time:

<Ctrl><Alt><Del>

The Task manger appears on the screen.
Click on the "Processes" tab, then click on "Image name", to sort them alphabetically.

Scroll thru the processes and find kalvwje32.exe.

<Click> on it to highlight it, then click "End Process".

Run Hijack This, and "fix":

O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvwje32.exe

Find and delete this file:

C:\windows\system32\kalvwje32.exe

Reboot.

Make another log file.

If the above entry is gone, post the log into this thread so I can be sure nothing new has shown up.

If that entry is still there, please carry out the instructions in my previous post.

[nena1974]

i will do your suggestions as soon as i get to work in the morning. One thing, C:\windows\system32\kalvwje32.exe was not in the system32 folder, could it be somewhere else??

[Micah_6:8]

Did you show hidden files when looking for it?