Bos'n
Ok, here is what I did tonight.
I used regedit to search for ppyunp (the ppyunp.exe that keeps showing up in my startup folder) and deleted any references to it.
I used regedit to search for Narrator (this is just a windows narrator that I do not need) and deleted all references to it, as this is where the ooyiko file was referenced, thought maybe it was hidden in there somewhere and coming back from there.
I used Explorer to search for files with ppyunp within them. Found 2 of interest, in C:\Documents and Settings\All Users\Documents\DrWatson\, usr.dmp and drwaton.log. I deleted these files, as they were dated as of my last reboot, moments before. Needed killbox.exe to kill the usr.dmp file which, btw, was about 24 M in size.
I deleted all Temp files, all Temporary Internet files under all users.
I used Registrar Lite to search for ooyiko. No results.
I used Registrar Lite to search for uuzoau. Found a bunch of pending file renames and deleted these.
I ran AdAware and let it kill the VX2 and CoolWeb stuff it found, and made sure that uuzoau.dll and ooyiko.exe did not exist in System32 and that ppyunp was not in Startup. I emptied the recycle bin. I rebooted and verified that these files did not exist. I watched these directories for a while. They did not reappear. I kicked off AdAware and started to type up this message. About 10 minutes has gone by and I just checked for the files again, and they are all back, and AdAware has found 8 critical Objects, all related to VX2 and CW.
Grr.
I am going to reboot into safe mode, and do most of the above again, then come back and finish this message with the results.
Went to delete uuzoa.dll first, but it is gone, all by itself.
In Safe Mode now.
I noticed an interesting folder.
C:\Documents and Settings\All Users\DRM
with the following files:
v2ks.bla
v2ks.sec
DRMv1.bak
DRMv1.key
drmv2.lic
drmv2.licIndex
drmv2.sst
that seem somewhat suspicious, especially the registry key.
AdAware has found nothing, I did find and delete ppnyunp.exe. ooyiko.exe appeared in a full search, but when I looked for it, it was gone, and I did not find uuzoau.
Rebooting.
The files are not visible yet. Searched registry with RegLite (very fast, I like it) and found ooyiko in the following address:
HKEY_USERS\S-1-5-21-1343024091-507921405-1708537768-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU\\002
Found ppyunp at the following address:
HKEY_USERS\S-1-5-21-1343024091-507921405-1708537768-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU\\000
and uuzoau at
HKEY_USERS\S-1-5-21-1343024091-507921405-1708537768-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU\\000
I have deleted these many times before, anywhere from the value, up to the Explorer Bars entry. They come back.
Here is the latest hjt log.
Logfile of HijackThis v1.99.0
Scan saved at 8:25:49 PM, on 02/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\ooyiko.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Registrar Lite\rl.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Hijack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/news/default.asp?0ct=-34o
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\Navnt\defalert.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {1C92EE3A-51FE-11D2-B506-00104BC858E1} (Digital Motorworks Date/Time Picker Control) - http://development.dmotorworks.com/activex…eTimePicker.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {CEEBC0A9-E9A8-11D2-B50D-00104BC858E1} (Digital Motorworks InfoIQ(SM) Entity Tree Control) - http://inca.dmotorworks.com/activex/IA/IAEntityTree.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: Cisco Systems, Inc. VPN Service - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Navnt\npssvc.exe
O23 - Service: OracleOraHome92ClientCache - Unknown - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
I used regedit to search for ppyunp (the ppyunp.exe that keeps showing up in my startup folder) and deleted any references to it.
I used regedit to search for Narrator (this is just a windows narrator that I do not need) and deleted all references to it, as this is where the ooyiko file was referenced, thought maybe it was hidden in there somewhere and coming back from there.
I used Explorer to search for files with ppyunp within them. Found 2 of interest, in C:\Documents and Settings\All Users\Documents\DrWatson\, usr.dmp and drwaton.log. I deleted these files, as they were dated as of my last reboot, moments before. Needed killbox.exe to kill the usr.dmp file which, btw, was about 24 M in size.
I deleted all Temp files, all Temporary Internet files under all users.
I used Registrar Lite to search for ooyiko. No results.
I used Registrar Lite to search for uuzoau. Found a bunch of pending file renames and deleted these.
I ran AdAware and let it kill the VX2 and CoolWeb stuff it found, and made sure that uuzoau.dll and ooyiko.exe did not exist in System32 and that ppyunp was not in Startup. I emptied the recycle bin. I rebooted and verified that these files did not exist. I watched these directories for a while. They did not reappear. I kicked off AdAware and started to type up this message. About 10 minutes has gone by and I just checked for the files again, and they are all back, and AdAware has found 8 critical Objects, all related to VX2 and CW.
Grr.
I am going to reboot into safe mode, and do most of the above again, then come back and finish this message with the results.
Went to delete uuzoa.dll first, but it is gone, all by itself.
In Safe Mode now.
I noticed an interesting folder.
C:\Documents and Settings\All Users\DRM
with the following files:
v2ks.bla
v2ks.sec
DRMv1.bak
DRMv1.key
drmv2.lic
drmv2.licIndex
drmv2.sst
that seem somewhat suspicious, especially the registry key.
AdAware has found nothing, I did find and delete ppnyunp.exe. ooyiko.exe appeared in a full search, but when I looked for it, it was gone, and I did not find uuzoau.
Rebooting.
The files are not visible yet. Searched registry with RegLite (very fast, I like it) and found ooyiko in the following address:
HKEY_USERS\S-1-5-21-1343024091-507921405-1708537768-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU\\002
Found ppyunp at the following address:
HKEY_USERS\S-1-5-21-1343024091-507921405-1708537768-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU\\000
and uuzoau at
HKEY_USERS\S-1-5-21-1343024091-507921405-1708537768-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU\\000
I have deleted these many times before, anywhere from the value, up to the Explorer Bars entry. They come back.
Here is the latest hjt log.
Logfile of HijackThis v1.99.0
Scan saved at 8:25:49 PM, on 02/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\ooyiko.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Registrar Lite\rl.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Hijack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/news/default.asp?0ct=-34o
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\Navnt\defalert.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {1C92EE3A-51FE-11D2-B506-00104BC858E1} (Digital Motorworks Date/Time Picker Control) - http://development.dmotorworks.com/activex…eTimePicker.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {CEEBC0A9-E9A8-11D2-B50D-00104BC858E1} (Digital Motorworks InfoIQ(SM) Entity Tree Control) - http://inca.dmotorworks.com/activex/IA/IAEntityTree.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: Cisco Systems, Inc. VPN Service - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - C:\PROGRA~1\Navnt\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - C:\PROGRA~1\Navnt\navapsvc.exe
O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Navnt\npssvc.exe
O23 - Service: OracleOraHome92ClientCache - Unknown - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
