lobstermaster
Topic Starter
Hi,
My computer is infected with CWS and I suspect it is a new variant.
Pre-Symptoms:
1. I installed and ran a software called Torrent Search
2. I accidently ran a dodgy software called "ywo.exe"
Symptoms:
1. My screen suddenly flashed and system request to "shut down". I ignore this and shut down my computer later.
2. The next day I boot up my computer and could not go to default homepage - Google (DNS error message)
3. I ran NAV, found a trojan "installer2.exe" and deleted it.
4. I rebooted my computer and can access the internet.
5. From time to time, browser windows keep popping up (they are all ads).
6. From time to time, the system install by itself 2 programs called "Windows Ad Blocker" and "Virtual Bouncer"
7. Spybot v1.3 yield the following,
VBouncer: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-606747145-413027322-725345543-500\Software\VB and VBA Program Settings\VBouncer
Common hijacker: Redirected host (Redirected host, nothing done)
Common hijacker: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Bootconf: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Loadbat: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Msconfd: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Oslogo: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Tapicfg: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Xmlmimefilter: Redirected host (Redirected host, nothing done)
DownloadWare: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-606747145-413027322-725345543-500\Software\Updater
IGetNet: Redirected host (Redirected host, nothing done)
Network Essentials.SmartPops: Executable (File, nothing done)
C:\Program Files\Recommended Hotfix - 421701D\v15\RH.exe
Network Essentials.SmartPops: Library (File, nothing done)
C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
Network Essentials: Type library (SP 1.0 Type Library) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{FA777197-4BF7-4AA9-A088-A0D803198DE0}
Network Essentials: Application ID (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C81CFF28-6DF1-402F-B78C-D9493EF59882}
Network Essentials: Application ID (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\HP.EXE
Network Essentials: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{0421701D-CF13-4E70-ADF0-45A953E7CB8B}
Network Essentials: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{E79061BA-B6E7-4A9D-A07C-C3CB561013B4}
Network Essentials: Interface (IHopper) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{FB82CCD5-174B-4379-BC37-72D9B5ADAEDA}
Network Essentials: Interface (IHopperEvents) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1423903E-86CC-4470-8AB0-257C10D77D45}
Network Essentials: Interface (ISmartPops) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A8516F49-8046-4295-8EE9-C59D5041C9E2}
Network Essentials: Interface (ISPCommand) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A42DC659-33B5-409E-A433-650AC42ECCA4}
Network Essentials: Interface (ISPSearch) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{4DEA7CA1-3372-4204-937C-2DD4A6ED6562}
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\SP.SmartPops.1
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\SP.SmartPops
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\HP.Hopper.1
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\HP.Hopper
Network Essentials: Type library (HP 1.0 Type Library) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{47350D97-09E9-4590-864E-3431DA53BF37}
Network Essentials: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-606747145-413027322-725345543-500\Software\Hopper
Virtual Bouncer: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VBouncerDL
Virtual Bouncer: Cryptography services (Registry value, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Services\DistID
Virtual Bouncer: Program directory (Directory, nothing done)
C:\Program Files\VBOUNCER\
All the redirected host have values pointing to 69.20.16.183
8. I discover the HOST file has the following entires:
127.0.0.1 localhost
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com
69.20.16.183 ieautosearch
69.20.16.183 ieautosearch
69.20.16.183 auto.search.msn.com
69.20.16.183 search.netscape.com
69.20.16.183 ieautosearch
9. Everytime I boot up my machine, I have an error message regarding some dll files. I notice there are a couple of dll files which have weired names like nkwrspt.dll date-stamped yesterday and today and all have the same size ie 220 Kb. There is also a file called "guard". These files all look the SAME when opened with NotePad.
What I tried to do but in vain:
1. I ran CWShredder v2.12, found the CWS.Bootconf and CWS.Svchost32, fixed them but they keep re-surfacing everytime I ran CWShredder.
2. I ran Spybot v1.3, have to click "Fixed Selected Problems" several times before all problems are fixed. However, these problems reappear again later.
3. I tried deleting the entires in the HOST file or deleting the HOST file completely but it keep reappearing.
Here is my Hijack This log,
Logfile of HijackThis v1.99.0
Scan saved at 02:57:18, on 03/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\TPPALDR.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINNT\system32\ntsmod.exe
C:\Program Files\MSI\FuzzyLogic4\FuzzyLogic4.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Motorola\A920 Desktop Suite\ConnMngmntBox.exe
C:\Program Files\Motorola\A920 Desktop Suite\ECTaskScheduler.exe
C:\PROGRA~1\Motorola\A920DE~1\Elogerr.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\PROGRA~1\Motorola\A920DE~1\BROADC~1.EXE
C:\PROGRA~1\Motorola\A920DE~1\SCRFS.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\SED\SED.exe
C:\PROGRA~1\RECOMM~1\v15\rh.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Administrator\桌面\Anti_SpyWares\HijackThis.exe
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1028,收音機[&R] - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-au\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RegKillElbyCheck] "C:\Program Files\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe" /L RegKill
O4 - HKLM\..\Run: [RegKillTray] "C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\TPPALDR.EXE
O4 - HKLM\..\Run: [PCDRealtime] C:\WINNT\realtime.exe
O4 - HKLM\..\Run: [_KAVImmuniteSasser] LsassPatch.EXE
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ntsmod] C:\WINNT\system32\ntsmod.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [VBouncerDL] C:\Program Files\VBouncer\VBouncerInner.exe /S
O4 - HKCU\..\Run: [WrCtrl] "C:\Program Files\WinRoute Pro\wrctrl.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: ActiveCheckout - about:
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0765D24E-1F68-4D89-9B57-06F0BC0744E9} (Siebel Option Pack for IE 7.5.3) - http://vus300.in.telstra.com.au/ecommAdmin…lOptionPack.cab
O16 - DPF: {205E7068-6D03-4566-AD06-A146B592FBA5} (Loader Class v2) - http://wsapp0426/tdbin/Spider80.ocx
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/28c03694ac904f9cbc05/…RdxIE601_tw.cab
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\trial\intrlnch\IntraLaunch.CAB
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NetProxy - Unknown - C:\Program Files\NetProxy3\NPSERV30.EXE (file missing)
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WinRoute - Unknown - C:\Program Files\WinRoute Pro\Winroute.exe (file missing)
O23 - Service: Iomega Active Disk - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe
Please help me kill this CWS thing on my computer. Your assistance is very much appreciated.
Many thanks,
lobstermaster
My computer is infected with CWS and I suspect it is a new variant.
Pre-Symptoms:
1. I installed and ran a software called Torrent Search
2. I accidently ran a dodgy software called "ywo.exe"
Symptoms:
1. My screen suddenly flashed and system request to "shut down". I ignore this and shut down my computer later.
2. The next day I boot up my computer and could not go to default homepage - Google (DNS error message)
3. I ran NAV, found a trojan "installer2.exe" and deleted it.
4. I rebooted my computer and can access the internet.
5. From time to time, browser windows keep popping up (they are all ads).
6. From time to time, the system install by itself 2 programs called "Windows Ad Blocker" and "Virtual Bouncer"
7. Spybot v1.3 yield the following,
VBouncer: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-606747145-413027322-725345543-500\Software\VB and VBA Program Settings\VBouncer
Common hijacker: Redirected host (Redirected host, nothing done)
Common hijacker: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Bootconf: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Loadbat: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Msconfd: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Oslogo: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Tapicfg: Redirected host (Redirected host, nothing done)
CoolWWWSearch.Xmlmimefilter: Redirected host (Redirected host, nothing done)
DownloadWare: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-606747145-413027322-725345543-500\Software\Updater
IGetNet: Redirected host (Redirected host, nothing done)
Network Essentials.SmartPops: Executable (File, nothing done)
C:\Program Files\Recommended Hotfix - 421701D\v15\RH.exe
Network Essentials.SmartPops: Library (File, nothing done)
C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
Network Essentials: Type library (SP 1.0 Type Library) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{FA777197-4BF7-4AA9-A088-A0D803198DE0}
Network Essentials: Application ID (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C81CFF28-6DF1-402F-B78C-D9493EF59882}
Network Essentials: Application ID (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\HP.EXE
Network Essentials: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{0421701D-CF13-4E70-ADF0-45A953E7CB8B}
Network Essentials: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{E79061BA-B6E7-4A9D-A07C-C3CB561013B4}
Network Essentials: Interface (IHopper) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{FB82CCD5-174B-4379-BC37-72D9B5ADAEDA}
Network Essentials: Interface (IHopperEvents) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1423903E-86CC-4470-8AB0-257C10D77D45}
Network Essentials: Interface (ISmartPops) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A8516F49-8046-4295-8EE9-C59D5041C9E2}
Network Essentials: Interface (ISPCommand) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A42DC659-33B5-409E-A433-650AC42ECCA4}
Network Essentials: Interface (ISPSearch) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{4DEA7CA1-3372-4204-937C-2DD4A6ED6562}
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\SP.SmartPops.1
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\SP.SmartPops
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\HP.Hopper.1
Network Essentials: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\HP.Hopper
Network Essentials: Type library (HP 1.0 Type Library) (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{47350D97-09E9-4590-864E-3431DA53BF37}
Network Essentials: User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-606747145-413027322-725345543-500\Software\Hopper
Virtual Bouncer: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VBouncerDL
Virtual Bouncer: Cryptography services (Registry value, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Services\DistID
Virtual Bouncer: Program directory (Directory, nothing done)
C:\Program Files\VBOUNCER\
All the redirected host have values pointing to 69.20.16.183
8. I discover the HOST file has the following entires:
127.0.0.1 localhost
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com
69.20.16.183 ieautosearch
69.20.16.183 ieautosearch
69.20.16.183 auto.search.msn.com
69.20.16.183 search.netscape.com
69.20.16.183 ieautosearch
9. Everytime I boot up my machine, I have an error message regarding some dll files. I notice there are a couple of dll files which have weired names like nkwrspt.dll date-stamped yesterday and today and all have the same size ie 220 Kb. There is also a file called "guard". These files all look the SAME when opened with NotePad.
What I tried to do but in vain:
1. I ran CWShredder v2.12, found the CWS.Bootconf and CWS.Svchost32, fixed them but they keep re-surfacing everytime I ran CWShredder.
2. I ran Spybot v1.3, have to click "Fixed Selected Problems" several times before all problems are fixed. However, these problems reappear again later.
3. I tried deleting the entires in the HOST file or deleting the HOST file completely but it keep reappearing.
Here is my Hijack This log,
Logfile of HijackThis v1.99.0
Scan saved at 02:57:18, on 03/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\TPPALDR.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINNT\system32\ntsmod.exe
C:\Program Files\MSI\FuzzyLogic4\FuzzyLogic4.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Motorola\A920 Desktop Suite\ConnMngmntBox.exe
C:\Program Files\Motorola\A920 Desktop Suite\ECTaskScheduler.exe
C:\PROGRA~1\Motorola\A920DE~1\Elogerr.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\PROGRA~1\Motorola\A920DE~1\BROADC~1.EXE
C:\PROGRA~1\Motorola\A920DE~1\SCRFS.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\SED\SED.exe
C:\PROGRA~1\RECOMM~1\v15\rh.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Administrator\桌面\Anti_SpyWares\HijackThis.exe
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1028,收音機[&R] - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-au\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RegKillElbyCheck] "C:\Program Files\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe" /L RegKill
O4 - HKLM\..\Run: [RegKillTray] "C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\TPPALDR.EXE
O4 - HKLM\..\Run: [PCDRealtime] C:\WINNT\realtime.exe
O4 - HKLM\..\Run: [_KAVImmuniteSasser] LsassPatch.EXE
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ntsmod] C:\WINNT\system32\ntsmod.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [VBouncerDL] C:\Program Files\VBouncer\VBouncerInner.exe /S
O4 - HKCU\..\Run: [WrCtrl] "C:\Program Files\WinRoute Pro\wrctrl.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: ActiveCheckout - about:
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0765D24E-1F68-4D89-9B57-06F0BC0744E9} (Siebel Option Pack for IE 7.5.3) - http://vus300.in.telstra.com.au/ecommAdmin…lOptionPack.cab
O16 - DPF: {205E7068-6D03-4566-AD06-A146B592FBA5} (Loader Class v2) - http://wsapp0426/tdbin/Spider80.ocx
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/28c03694ac904f9cbc05/…RdxIE601_tw.cab
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\trial\intrlnch\IntraLaunch.CAB
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NetProxy - Unknown - C:\Program Files\NetProxy3\NPSERV30.EXE (file missing)
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WinRoute - Unknown - C:\Program Files\WinRoute Pro\Winroute.exe (file missing)
O23 - Service: Iomega Active Disk - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe
Please help me kill this CWS thing on my computer. Your assistance is very much appreciated.
Many thanks,
lobstermaster
Sounds like you resolved it - well done. If you want to learn more about removing malware have a look here: