Haxdoor-h - And Others ?

Can you please help ? If yes - thanks in advance.
Sbybot (latest including DSO Exploit fix) detects Haxdoor-H and claims to remove, but the trojan is back after a reboot. I also think there are several other malware items in my HJT log, but I am not sure which I can safely delete. VSP32, Explorar and lsassM look suspicuous.
Hereby my log :

Logfile of HijackThis v1.98.2
Scan saved at 20:12:56, on 23/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\WINDOWS\System32\lsassM.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\vsp32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Infection\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [Microsoft IE] IEXPLORE.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Default] lsassM.exe
O4 - HKLM\..\Run: [Microsoft Windows] explorar.exe
O4 - HKLM\..\Run: [den] C:\WINDOWS\den.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [VSP32 Controls] vsp32.exe
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\mszx23.exe !!
O4 - HKLM\..\RunServices: [Microsoft IE] IEXPLORE.EXE
O4 - HKLM\..\RunServices: [Default] lsassM.exe
O4 - HKLM\..\RunServices: [Microsoft Windows] explorar.exe
O4 - HKLM\..\RunServices: [VSP32 Controls] vsp32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft IE] IEXPLORE.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [VSP32 Controls] vsp32.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1105880083449

Please save the TrojanHunter log and post it with your next post. Go to "File" > "Save Scanreport". Use ctrl+c to copy the report and ctrl+v to paste it into the post.
E

Thanks again for the support.
I have followed all your instructions - except for the Trend Micro Housecall. Online scans were difficult, because of the constant redirects to a URL with Klikfeed in the name. Somehow I managed to complete the Panda scan but not the TMH. Since changing my Spybot settings according to the instructions via your link, I was able to prevent the klikfeed url from becoming my default browser search page.
Hereby HJT and TH logs.

Logfile of HijackThis v1.99.0
Scan saved at 21:07:51, on 27/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\WINDOWS\System32\lsassM.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Default] lsassM.exe
O4 - HKLM\..\Run: [Microsoft Windows] explorar.exe
O4 - HKLM\..\Run: [den] C:\WINDOWS\den.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\mszx23.exe !!
O4 - HKLM\..\Run: [VSP32 Controls] vsp32.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.1\THGuard.exe"
O4 - HKLM\..\RunServices: [Default] lsassM.exe
O4 - HKLM\..\RunServices: [Microsoft Windows] explorar.exe
O4 - HKLM\..\RunServices: [Microsoft IE] IEXPLORE.EXE
O4 - HKLM\..\RunServices: [VSP32 Controls] vsp32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Microsoft IE] IEXPLORE.EXE
O4 - HKCU\..\Run: [VSP32 Controls] vsp32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1105880083449
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Trojan Hunter

Registry scan
Registry key exists: HKEY_CLASSES_ROOT\CLSID\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} (matches Adware.WindUpdates.SyncroAd.100) (Regedit Jump)
Registry value exists: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Ie (matches LttLogger.100) (Regedit Jump)
Inifile scan
No suspicious entries found
Port scan
Port 16661/TCP is open (Matches Dfch.010. Port being used by process /PID 1064) (Tell me more about port alerts…)
Port 16661/TCP is open (Matches Grisch.100. Port being used by process /PID 1064) (Tell me more about port alerts…)
Memory scan
No trojans found in memory
File scan
Found possible trojan file: C:\WINDOWS\system32\qtvmjapm.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
Found possible trojan file: C:\WINDOWS\system32\giiyirhe.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
Found possible trojan file: C:\WINDOWS\system32\wsjapluu.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
Found possible trojan file: C:\WINDOWS\system32\axvnyfrl.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
Found possible trojan file: C:\WINDOWS\system32\opgaaaaa.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
Found possible trojan file: C:\WINDOWS\system32\kfmenaaa.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
Found possible trojan file: C:\WINDOWS\system32\ugdqaaaa.exe (Suspicious: UPX-packed file in Windows System folder) (What's a possible trojan file?) (Submit for analysis…) (Add to ignore list)
7 possible trojan files found

All the best.

Elrond
Thank you once again for your continuing support !
1. I have run xphidden.reg.
2. I did not succeed in submitting the files to TH, the hyperlink function is only available for licensed users, and I did not manage to work with the online Help file recommendations.
3. I have sent the 8 files in a zip to all the other addresses.
4.The 8 files had no manufacturer or version properties.
5. There was no entry in the list for "WindUpdates". I did find an entry for Winds 2.4, which I did not delete.
6. TDS3 run in safe mode - results attached. All positive id entries deleted.
7. Full NAV scan - results attached.
8. HJT rerun - log attached.
Let me know what you advise next. Best regards.

TDS3 :
Scan Control Dumped @ 16:41:06 29-01-05
RegVal Trace: RAT.Spook: HKEY_LOCAL_MACHINE
File: Software\Microsoft\Windows\CurrentVersion\RunServices [Microsoft Windows=explorar.exe]

RegVal Trace: Adware.ISTbar: HKEY_LOCAL_MACHINE
File: Software\Microsoft\Windows\CurrentVersion\Run [IST Service=C:\Program Files\ISTsvc\istsvc.exe]

RegVal Trace: RAT.Haxdoor: HKEY_LOCAL_MACHINE
File: Software\Microsoft\Windows\CurrentVersion\Run [Secboot=C:\WINDOWS\System32\mszx23.exe !!]

Positive identification: Trojan.Win32.LowZones.s1
File: c:\windows\system32\scst.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\qtvmjapm.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\giiyirhe.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\wsjapluu.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\axvnyfrl.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\opgaaaaa.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\kfmenaaa.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\ugdqaaaa.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\system32\eoceeaaa.exe

Positive identification (DLL): Adware.WinAD.p (dll)
File: c:\windows\downloaded program files\adstatservx.dll

Positive identification: Adware.WinAD.k3
File: c:\documents and settings\ruben\local settings\temporary internet files\content.ie5\h1510ahp\adstatkeep[1].exe

Positive identification: Adware.WinAD.k3
File: c:\program files\adstatus service\adstatkeep.exe

Positive identification (DLL): Adware.Relevance.b (dll)
File: c:\program files\searchrelevancy\searchrelevancy.dll

Positive identification: Trojan.Win32.LowZones.s1
File: c:\infection\quarantine\schst.exe

Positive identification: Trojan.Win32.LowZones.s1
File: c:\infection\quarantine\scst.exe

Suspicious Filename: HTA file in suspicious location
File: d:\system volume information\_restore{0d412fd5-7111-43f6-91b7-0305b0053821}\rp9\a0004069.hta

Suspicious Filename: Dual extensions
File: f:\dvdshrink\setupdvddecrypter_3.5.1.0.exe

NAV (sorry, Dutch version !):
Norton AntiVirus Quarantine-rapport
Gemaakt op: zaterdag 29 januari 2005 17:13:39
——————————————————————————

Bestandsnaam
Locatie
Status Grootte Virusnaam
Gebruikersnaam Machinenaam Domeinnaam
Quarantainedatum
Verzenddatum

——————————————————————————

HLLCXPA.EXE
C:\WINDOWS\SYSTEM32
Backup van een geïnfecteerd bestand 77.0 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 15:06:04
Niet verzonden

——————————————————————————

gilopa32.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 77.0 KB W32.Spybot.Worm
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:35:32
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:38:35
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:40:22
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 66 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
woensdag 15 december 2004 22:46:24
Niet verzonden

——————————————————————————

IEXPLORE.EXE
C:\WINDOWS\SYSTEM32
Backup van een geïnfecteerd bestand 92.10 KB W32.IRCBot.Gen
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 26 november 2004 14:01:03
Niet verzonden

——————————————————————————

istdownload[1].exe
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\H1510AHP
Backup van een verwijderd beveiligingsrisico 16.0 KB Packed.Adware
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:29
Niet verzonden

——————————————————————————

winlow.sys
C:\WINDOWS\System32
Backup van een geïnfecteerd bestand 4.00 KB Backdoor.Haxdoor.D
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zaterdag 29 januari 2005 14:36:44
Niet verzonden

——————————————————————————

sys03792.exe
C:\Documents and Settings\Ruben\Application Data\SysDown
Backup van een verwijderd beveiligingsrisico 68.5 KB Download.Adware
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:55
Niet verzonden

——————————————————————————

i.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 72 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
maandag 17 januari 2005 14:58:56
Niet verzonden

——————————————————————————

lassa32e.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 28.5 KB Backdoor.Trojan
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:35:32
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:43:14
Niet verzonden

——————————————————————————

msnmsgrr.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 88.0 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 26 november 2004 15:29:19
Niet verzonden

——————————————————————————

AdStatServ[1].exe
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\UV8PQ3AH
Backup van een verwijderd beveiligingsrisico 25.5 KB Adware.WinTaskAd
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:26
Niet verzonden

——————————————————————————

AdStatServ.exe
C:\Program Files\AdStatus Service
Backup van een verwijderd beveiligingsrisico 25.5 KB Adware.WinTaskAd
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:25
Niet verzonden

——————————————————————————

tmp5.tmp
C:\Documents and Settings\Ruben\Local Settings\Temp
Backup van een verwijderd beveiligingsrisico 26.6 KB Dialer.WSV
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:55
Niet verzonden

——————————————————————————

WinCtlAdX.dll
C:\WINDOWS\Downloaded Program Files
Backup van een verwijderd beveiligingsrisico 22.5 KB Adware.SyncroAd
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:44
Niet verzonden

——————————————————————————

TFTP4424
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 30.0 KB W32.Spybot.Worm
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:35:20
Niet verzonden

——————————————————————————

x[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OZSHGUT7
Backup van een geïnfecteerd bestand 9.13 KB W32.Korgo.V
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:32:50
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 129 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:52:37
Niet verzonden

——————————————————————————

ftpupd.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 9.13 KB W32.Korgo.V
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
woensdag 15 december 2004 22:54:35
Niet verzonden

——————————————————————————

wz.dll
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 4.00 KB Backdoor.Haxdoor.D
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 16:56:39
Niet verzonden

——————————————————————————

sys02076.exe
C:\Documents and Settings\Ruben\Application Data\SysDown
Backup van een verwijderd beveiligingsrisico 68.5 KB Download.Adware
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:54
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 72 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
maandag 17 januari 2005 16:04:35
Niet verzonden

——————————————————————————

i[1].html
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\KDE3OTIN
Backup van een verwijderd beveiligingsrisico 1.38 KB Adware.CDT
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:44:42
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:56:05
Niet verzonden

——————————————————————————

ftpupd.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 11.1 KB W32.Korgo.S
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
woensdag 15 december 2004 22:56:04
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 65 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 26 november 2004 15:44:27
Niet verzonden

——————————————————————————

questmod.dll
C:\WINDOWS
Backup van een verwijderd beveiligingsrisico 14.5 KB Adware.Sa
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:54
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:45:20
Niet verzonden

——————————————————————————

o
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 63 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zaterdag 27 november 2004 18:50:27
Niet verzonden

——————————————————————————

istrecover[1].exe
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\H1510AHP
Backup van een verwijderd beveiligingsrisico 6.51 KB Adware.Istbar!Dl
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:30
Niet verzonden

——————————————————————————

fi6NtG1.exe
C:\Documents and Settings\Ruben\Local Settings\Temp
Backup van een verwijderd beveiligingsrisico 16.0 KB Packed.Adware
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:28
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:58:43
Niet verzonden

——————————————————————————

explorar.exe
C:\WINDOWS\System32
Backup van een geïnfecteerd bestand 95.0 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
donderdag 16 december 2004 14:03:37
Niet verzonden

——————————————————————————

dbrbl.exe
C:\WINDOWS
Backup van een verwijderd beveiligingsrisico 6.51 KB Adware.Istbar!Dl
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:26
Niet verzonden

——————————————————————————

x[2].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OZSHGUT7
Backup van een geïnfecteerd bestand 11.1 KB W32.Korgo.S
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:32:50
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:50:27
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 121 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 18:04:34
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 73 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
donderdag 16 december 2004 14:11:24
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 68 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
maandag 29 november 2004 11:13:35
Niet verzonden

——————————————————————————

prompt[1].php
C:\Documents and Settings\Ruben\Local Settings\Temp\Temporary Internet Files\Content.IE5\7BACFBGF
Backup van een verwijderd beveiligingsrisico 5.97 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 122 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:58:33
Niet verzonden

——————————————————————————

o
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 59 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zaterdag 11 december 2004 16:48:33
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 18:14:32
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 69 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
dinsdag 21 december 2004 21:46:57
Niet verzonden

——————————————————————————

istsvc[1].exe
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\ODMNODYR
Backup van een verwijderd beveiligingsrisico 12.5 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:31
Niet verzonden

——————————————————————————

istsvc.exe
C:\Program Files\ISTsvc
Backup van een verwijderd beveiligingsrisico 12.5 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:31
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
maandag 10 januari 2005 19:52:58
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 18:18:03
Niet verzonden

——————————————————————————

o
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 63 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
woensdag 15 december 2004 21:30:01
Niet verzonden

——————————————————————————

.PIF
C:\WINDOWS\SYSTEM32
Backup van een geïnfecteerd bestand 69 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 26 november 2004 13:47:37
Niet verzonden

——————————————————————————

prompt[1].php
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\ODMNODYR
Backup van een verwijderd beveiligingsrisico 5.102 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ WORKGROUP
dinsdag 25 januari 2005 23:01:29
Niet verzonden

——————————————————————————

a[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OZSHGUT7
Backup van een geïnfecteerd bestand 1.01 KB Download.Trojan
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:32:50
Niet verzonden

——————————————————————————

ftpupd.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 9.14 KB W32.Korgo.X
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zaterdag 15 januari 2005 17:46:56
Niet verzonden

——————————————————————————

.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 68 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
dinsdag 21 december 2004 22:20:30
Niet verzonden

——————————————————————————

prompt[1].php
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\KDE3OTIN
Backup van een verwijderd beveiligingsrisico 5.97 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 123 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 18:22:43
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:27:24
Niet verzonden

——————————————————————————

i[1].html
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7O983HYB
Backup van een verwijderd beveiligingsrisico 1.13 KB Adware.CDT
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

ldrx32a.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 4.51 KB Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 13:52:42
Niet verzonden

——————————————————————————

temp.fr2BE2
C:\Documents and Settings\Ruben\Local Settings\Temp
Backup van een verwijderd beveiligingsrisico 25.5 KB Adware.WinTaskAd
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:32
Niet verzonden

——————————————————————————

tmpE.tmp
C:\Documents and Settings\Ruben\Local Settings\Temp
Backup van een verwijderd beveiligingsrisico 26.6 KB Dialer.WSV
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:56
Niet verzonden

——————————————————————————

z.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 78.0 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:30:46
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 122 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
dinsdag 4 januari 2005 15:12:13
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:28:39
Niet verzonden

——————————————————————————

tmpf01.exe
C:\WINDOWS\System32
Backup van een geïnfecteerd bestand 2.08 KB Downloader.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
donderdag 27 januari 2005 19:36:23
Niet verzonden

——————————————————————————

24tgs.exe
C:
Backup van een verwijderd beveiligingsrisico 1.01 KB Download.Adware
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

ldrx32a[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5UASWXNC
Backup van een geïnfecteerd bestand 4.51 KB Download.Trojan
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:32:50
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 121 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:34:36
Niet verzonden

——————————————————————————

ysb.dll
C:\Documents and Settings\Ruben\Local Settings\Temp
Backup van een verwijderd beveiligingsrisico 93.0 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:32
Niet verzonden

——————————————————————————

LSVCHOST.EXE
C:\WINDOWS\SYSTEM
Backup van een geïnfecteerd bestand 28.5 KB Backdoor.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 15:06:04
Niet verzonden

——————————————————————————

prompt[1].php
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\ODMNODYR
Backup van een verwijderd beveiligingsrisico 5.102 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

x[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5FYIYX62
Backup van een geïnfecteerd bestand 9.14 KB W32.Korgo.X
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:32:49
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:37:50
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 120 KB W32.Spybot.Worm
W32.Spybot.Worm ACER-7NH0KUBLQZ WORKGROUP
vrijdag 7 januari 2005 23:31:05
Niet verzonden

——————————————————————————

ysb[1].dll
C:\Documents and Settings\Ruben\Local Settings\Temporary Internet Files\Content.IE5\KDE3OTIN
Backup van een verwijderd beveiligingsrisico 93.0 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:33
Niet verzonden

——————————————————————————

ysb.dll
C:\Program Files\YourSiteBar
Backup van een verwijderd beveiligingsrisico 93.0 KB Adware.Istbar
Ruben ACER-7NH0KUBLQZ ACER-7NH0KUBLQZ
zaterdag 29 januari 2005 17:09:32
Niet verzonden

——————————————————————————

tmpf01.exe
C:\WINDOWS\System32
Backup van een geïnfecteerd bestand 2.08 KB Downloader.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
donderdag 27 januari 2005 19:43:23
Niet verzonden

——————————————————————————

tmp6.tmp
C:\Documents and Settings\Ruben\Local Settings\Temp
Backup van een verwijderd beveiligingsrisico 26.6 KB Dialer.WSV
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:55
Niet verzonden

——————————————————————————

sys02436.exe
C:\Documents and Settings\Ruben\Application Data\SysDown
Backup van een verwijderd beveiligingsrisico 68.5 KB Download.Adware
Ruben ACER-7NH0KUBLQZ WORKGROUP
zaterdag 22 januari 2005 17:08:54
Niet verzonden

——————————————————————————

i[1].html
C:\Documents and Settings\Ruben\Local Settings\Temp\Temporary Internet Files\Content.IE5\7BACFBGF
Backup van een verwijderd beveiligingsrisico 1.38 KB Adware.CDT
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:42
Niet verzonden

——————————————————————————

a2211.exe
C:
Backup van een geïnfecteerd bestand 1.01 KB Download.Trojan
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:43:07
Niet verzonden

——————————————————————————

taskmgr32.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 83.1 KB W32.Spybot.Worm
Ruben ACER-7NH0KUBLQZ WORKGROUP
zondag 16 januari 2005 14:35:32
Niet verzonden

——————————————————————————

svcnhost.exe
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 119 KB W32.Spybot.Worm
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
zondag 2 januari 2005 17:38:29
Niet verzonden

——————————————————————————

i.pif
C:\WINDOWS\system32
Backup van een geïnfecteerd bestand 70 bytes Download.Trojan
SYSTEM ACER-7NH0KUBLQZ WORKGROUP
vrijdag 26 november 2004 13:47:35
Niet verzonden

——————————————————————————

HJT :

Logfile of HijackThis v1.99.0
Scan saved at 17:23:19, on 29/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\WINDOWS\System32\lsassM.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Default] lsassM.exe
O4 - HKLM\..\Run: [Microsoft Windows] explorar.exe
O4 - HKLM\..\Run: [den] C:\WINDOWS\den.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe
O4 - HKLM\..\Run: [VSP32 Controls] vsp32.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.1\THGuard.exe"
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\mszx23.exe !!
O4 - HKLM\..\RunServices: [Default] lsassM.exe
O4 - HKLM\..\RunServices: [Microsoft Windows] explorar.exe
O4 - HKLM\..\RunServices: [Microsoft IE] IEXPLORE.EXE
O4 - HKLM\..\RunServices: [VSP32 Controls] vsp32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft IE] IEXPLORE.EXE
O4 - HKCU\..\Run: [VSP32 Controls] vsp32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1105880083449
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Elrond
Once again thanks for the quick response !
I didn't expect a reply on a Sunday..

1. TH quickscan
Registry scan
Registry key exists: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YourSiteBar (matches Adware.IST-YourSiteBar.100) (Regedit Jump)
Registry key exists: HKEY_CLASSES_ROOT\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686} (matches Adware.IST-YourSiteBar.100) (Regedit Jump)
Registry key exists: HKEY_CLASSES_ROOT\TypeLib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6} (matches Adware.IST-YourSiteBar.100) (Regedit Jump)
Registry key exists: HKEY_LOCAL_MACHINE\SOFTWARE\ISTsvc (matches Adware.ISTBar.211) (Regedit Jump)
Registry key exists: HKEY_CURRENT_USER\Software\IST (matches Adware.ISTBar.211) (Regedit Jump)
Registry key exists: HKEY_CLASSES_ROOT\CLSID\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} (matches Adware.WindUpdates.SyncroAd.100) (Regedit Jump)
Inifile scan
No suspicious entries found
Port scan
No suspicious open ports found
Memory scan
No trojans found in memory
File scan (autostarted files, running executables)
No trojan files found

4. HJT - 14 files fixed in safe mode.

5. Files/folders to be deleted, deleted except :

den.exe not found

mszx23.exe would not delete, system message says it is in use
by another user / program

vsp32.exe not found.

All files which should be gone, gone or deleted ok.

6.
No occurrences of explorar.exe found

3 listings for IEXPLORE.EXE (i didn't delete any)
IEXPLORE.EXE27122324.pf in C:\WINDOWS\Prefetch
IEXPLORE.EXE in C:\Program Files\Internet Explorer
iexplore.exe in C:\WINDOWS\system32\dllcache

8. HJT scan :
Logfile of HijackThis v1.99.0
Scan saved at 22:34:29, on 30/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.1\THGuard.exe"
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\mszx23.exe !!
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1105880083449
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

OK TonyEss
You did well in the last round.

I am not suprised that you could not find "explorar.exe". My fault. Made a typo. It should have been explorer.exe.

That you could not delete mszx23.exe is not suprising at all. It is a new and nasty version of the Haxdoor Trojan that protects itself in many ways.

Please make sure that you have printed all the instructions and preferebly also copied them to Notepad as you will need to do a lot of the work in safe mode without having this post in front of you.

Let's start with the easy part.

1. "Run "Start">"Search">"All Files and Folders"> enter explorer.exe in "All or part of file name". Select "More advanced options". Check-mark "Search System Folders", "Search hidden files and folders", and "Search subfolders". Click "Search". Post the locations of the file(s) in your next post. If there is more than one and one of them in c:\windows\system32 please delete that one. Leave any other explorer.exe in place. Explorer.exe is the name of a legitimate and very important file in Windows.

2. Copy the data from the code box below to a notepad file.
Save to the DESKTOP (so you can find it) as ALL FILES, with the name of KILLHX.REG

REGEDIT4


[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdmt16]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winlow]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ENUM\ROOT\LEGACY_WINLOW]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ENUM\ROOT\LEGACY_VDMT16]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\memlow]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ENUM\ROOT\LEGACY_MEMLOW]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\drct16]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"secboot"=-
"tibs3"=-

[HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters]
"Disable TrayIcon"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"StackSize"=-
"Impersonate"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion]
"hws"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Session Manager\Memory Management]
"EnforceWriteProtect"=-
"hws"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"EnforceWriteProtect"=-
"hws"=-

3. Download Killbox.zip here
Extract it from the zip file.

4. Disconnect from the internet by whatever means you need to use. (Switching of your router, unplugging your telephone line etc.)

5. Go to Killbox and double-click on Killbox.exe to run it. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:
C:\WINDOWS\system32\mszx23.exe
Select "Delete on Reboot". Then click the the white X in the red circle.
Click "Yes" in the first dialog box to delete at reboot and "No" in the second dialog box to avoid reboot now.

Repeat the procedure for each of the following files.
C:\WINDOWS\system32\Tibs3.exe
C:\WINDOWS\system32\drct16.dll
C:\WINDOWS\system32\vdmt16.sys
C:\WINDOWS\system32\winlow.sys
C:\WINDOWS\system32\WaiZ.
C:\WINDOWS\system32\w32tm.exe After the last file you should answer yes to the second dialog box.

6. Do the reboot into "Safe Mode".

7. Double click the file KILLHX.REG - when it asks say yes to merging with the registry.

8. Run Killbox again and clear the temp files
- choose Tools > Delete Temp Files and click OK

9. Open Windows Explorer and navigate to the C:\Windows\System32 folder
You will likley want the details view and to sort the files by DATE (Arrange icons –> modified)

Have a look for the following files (which should all be about the same date)
Some of them may not be present and there may be some which I haven't listed. If so let me know.
C:\WINDOWS\system32\mszx23.exe
C:\WINDOWS\system32\Tibs3.exe
C:\WINDOWS\system32\w32tm.exe
C:\WINDOWS\system32\drct16.dll
C:\WINDOWS\system32\cz.dll
C:\WINDOWS\system32\vdmt16.sys
C:\WINDOWS\system32\hz.dll
C:\WINDOWS\system32\winlow.sys
C:\WINDOWS\system32\wz.dll
C:\WINDOWS\system32\p2.ini
C:\WINDOWS\system32\es.
C:\WINDOWS\system32\WaiZ.
C:\WINDOWS\system32\z.
C:\WINDOWS\system32\—I0¢+opes.
C:\WINDOWS\system32\slowIsys.
C:\WINDOWS\system32\zININEwz.
C:\WINDOWS\system32\2Ioso.
C:\WINDOWS\system32\3d.
C:\WINDOWS\system32\|msz.
If you find these files delete them.
If you are unsure then save a copy to a floppy or similar

10. Reconnect to the internet.

11. Reboot in "Normal Mode".

12. Double click the file KILLHX.REG once again - when it asks say yes to merging with the registry.

13. Run Symantec live update.

14. * Close ALL windows except HJT
* SCAN with HJT
* POST the new log in this thread using "Add Reply"

We will have go through another round but hopefully we got rid of the bad once now and the next round will be housekeeping.

We will conquer this misserable piece of malware.

E

Hello Elrond

As usual, really appreciate your help.
The computer just feels cleaner now.
Best regards.

……………………………………
explorer.exe

These files exist :
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dllcache\explorer.exe
C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

C:\drv\btw\Data1.cab\btsendto_explorer.exe

C:\Program Files\TrojanHunter4.1\Tools\
Autostart Explorer\AutostartExplorer.exe

……………………………………
killbox executed for the files listed.

killhx.reg has been run.
…………………………………….
regarding the check for files in system32 :

all files you listed have been deleted, or were not found,
except for w32tm.exe.
are you sure about that one ? it has a Microsoft signature
and version numer 5.1.2600 dated 8/4/2004 which all makes
it look legitimate.

suspicious entries are :
i.a3d
klogini.dll
vdnt32.sys
pav.sig
wpa.dbl
tmpf01.exe
klo5.sys
ps.a3d
(they all have no manufacturer and are changed on the last
two to three days).
………………………………………

HJT log :
Logfile of HijackThis v1.99.0
Scan saved at 22:16:10, on 31/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.1\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1105880083449
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Well done TonyEss

I believe that we got rid of all the infections.
You were right not to delete w32tm.exe as the one you found is a valid Windows file. I think we got rid of all the bad files and your log looks clean.

Please inform me if your computer behaves in any way odd.

Now that your computer is free of malware, I want you to take some precautions to avoid being re-infected.

Settings and maintenance

1. Clean out temporary files.
Run System Security Suite by clicking the 3S icon in program manager.
Under "items to clear" check mark all. Then click "clear selected items"
This will cause your system to reboot. as you allready know.

It is a good idea to do this once a month or so to get rid of all the junk that accumulates.

2. Clean Out System Restore.
Malware could get backed up in System Restore.
For Win XP follow these instructions to delete all restore points.
1. Go to "Start" > "Control Panel".
2. Make sure the Control Panel is in "Classic View". If it is not, click "Switch to Classic View" towards the top-left of the screen.
3. Double-click "System" and go to the "System Restore" tab.
4. Check "Turn off System Restore" and click "OK" and then "Yes".

After restarting your computer you should turn it back on by following the above procedure and uncheck "Turn off System Restore".

You can find out more about this subject at How to turn off or turn on Windows XP System Restore


3. You reconfigured Windows to show hidden files and you should reset this to its original state useing the instructions from here except that
1. Under the "Hidden files and folders" heading put a mark for "Do not show hidden files and folders".
2. Uncheck "Display content of system folders"
3. Check the "Hide protected operating system files (recommended)" option.


4. Make your Internet Explorer more secure
This can be done by following these simple instructions that apply to all "Windows" except "Windows XP with SP2". In SP2 many of those setting are the default settings but check your settings anyhow. The settings can become restrictive but you should use them anyhow. If there are sites that will not show up right with those settings and that you rely on to be free of malware place them in the trusted zone.

1. Click "Start". Open "Control Panel".
2. Select the "Internet Options"
3. Select "Security" Tab and select the following settings.

* ActiveX controls and plug-ins
• Download signed ActiveX controls: Disable
• Download unsigned ActiveX controls: Disable
• Initialize and script ActiveX controls not marked as safe: Disable
• Run ActiveX controls and plug-ins: Disable
• Script ActiveX controls marked safe for scripting: Disable

* Downloads
• Font Download: Disable

* Microsoft VM
• Java permissions: Disable Java

* Miscellaneous
• Allow META REFRESH: Disable
• Display mixed content: Disable
• Drag and drop or copy and paste files: Disable
• Installation of desktop items: Disable
• Launching programs and files in an IFRAME: Disable
• Navigate sub-frames across different domains: Disable
• Software channel permissions: High Safety
• Userdata persistence: Disable

* Scripting
• Active scripting: Disable
• Allow paste operations via script: Disable
• Scripting of Java applets: Disable

* User Authentication
• Logon: Prompt for username and password
4. When all these settings have been made, click on the OK button.
5. If it prompts you as to whether or not you want to save the settings, press the Yes button.
6. Next press the Apply button and then the OK to exit the Internet Properties page.


These are a must to protect yourself from malware.
1. Get a good anti-virus if you don't have one. A lot of people like AVG .
If you have an old copy do not use it. AVG Free 7 has been released and version 6 will not be supported and updated anymore.
KEEP IT UPDATED

2. Get a good firewall if you don't have one.
Many like ZoneAlarm. You can download a free copy here

Be restrictive with access to the internet. If you are unsure if the program really needs the access, test it by denying the access and see if this has any negative effects. If not make the block permanent.

3. MOST IMPORTANT: You Need to keep “Windows” and "Internet Explorer” updated. Open ‘Internet Explorer” and go to”Start”> "Tools" > "Windows Update" or go to Microsoft Windows and Internet Explorer Updates to get the critical updates.

If you are running Microsoft Office, or any portion thereof you must keep it updated as well. Go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed. Update MS Office here.

4. Download and install “SpywareBlaster”
Run it. Click "Updates" at the left and click "Check for Updates". After updating click "Protection" at the left and towards the bottom click "Enable All Protection". You should now be protected from all known bad ActiveX. You should occasionally check for updates.

5. Download and install "SpywareGuard"

Further tools

I highly recommend downloading and installing the newest versions of “AdAware SE Personal” and “Spybot Search and Destroy”
After installing remember to update the definition files for each program.
I also suggest that you visit this website and follow the instructions on how to configure both programs for best detection. These instructions are the best even though they refer to a cleanup of an infected computer.

There are many other programs that will add extra layers of protection to your computer as well.
I recommend “IE-Spyad” By default, it is unzipped to "C:\ie-spyad". Find out how to install it by going to the "ReadMe.txt". You should occasionally get updates by using the bat file or by uninstalling and deleting the old files and returning to the site to get the new version.

A Trojan scanner would be also be helpful. You can download a trial version of “Trojan Hunter” and run it to remove any traces of trojans.

The ”a Squared” trojan Scanner has a free version. It is an onboard trojan scanner that is installed much like Spybot/AdAware but handles trojans. Nice to add to your armor if you wish.
Download free from “a Squared” (The download button is at the bottom of the page). Install it.
Run and activate your free version with a Squared and then select
Scan your computer for malware infections .
Then select any/all drives.
Finally Scan selected folders.

It is worth while to take a look at "So how did I get infected in the first place? for some good advice.

A good source of information about computer secutiy can be found at this website . ChrisRLG is an Administrator and Classroom Teacher at Tom Coyote.


If you want to update Windows XP with SP2, you should know that there has been a small group of users who have had problems with it. The risks are the least if your computer is clean of malware and you are running an updated software firewall such as ZoneAlarm. You can download SP2 from http://support.microsoft.com/kb/322389
If you have a high-speed internet connection, you can let Windows Update do it. However if you have a dialup connection I would advise you to order the CD as the download is huge and will take a VERY long time to download. There has also been some reports that there is less problems when SP2 is installed from a CD.
You can get the CD here .


Update all protective programs regularly - Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Best of luck and clean computing
Elrond