Hijack This Log

Hello in2bud, Welcome back to TomCoyote forum. On Jan 8 2005, 09:05 AM MrCharlie posted a extensive fix for the malware on your computer. You never returned to respond to that fix and as a result the post was closed on Feb 6 2005, 08:07 AM. Do you intend to continue with this post if I involve my time in trying to clean up your computer? If you do, then follow these instructions on a timely basis. Thank up.

We need to run our big guns for cleaning out malware. Ad-aware and Spybot can get the areas we can't reach with the HJT tool. I am going to give you links to tutorials and it is important that you take the time to review the information, then to download, update, configure exactly as in the tutorials and remove what is suggested in the tutorials. Make notes of anything these two programs can't remove, the exact name and location of the item. Run Spybot first, if you receive any DSO Exploit notifications, ignore them and please do not activate TeaTimer at this time, once you are clean you may activate it. If Spybot removes anything reboot before running Ad-aware SE Personal.
Spybot:
http://www.bleepingcomputer.com/forums/tutorial43.html
Ad-aware:
http://www.bleepingcomputer.com/forums/tutorial48.html

Free online scans
Now I want you to use these free online scans to kill the trojans, set them to clean/fix and remember we need the complete name and location of anything the scans locate but can't kill. Please give me feedback concerning what each scan accomplished. This will help me access the value of the tool for future scans. Thanks.
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.pandasoftware.com/activescan/co…n_principal.htm

You are running an outdated version of HJT. Update like this: "Config"=>"Misc Tools"=>"Check for updates online" then stay in this tread and post a new log. Include the information I requested and any comments you feel I should have.
Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you get help here consider a donation:
http://tomcoyote.com/donate.php

pskelly, Thank you for taking the time to look at my log. When i first posted in January, i did not have admin rights on this machine. i should have reposted a response, but did not. i tried to delete the items mrcharley suggested, but obviously failed. Right now, however, my problem is outlook is not functioning properly. i will try to follow the steps above, and repost. thanx, in2bud

Mcafee virus scan thinks hijack this (new version) is a worm and deletes it when i try to install…

We had this issue with McAfee when the new version was released a week or so ago, I could not download it myself. McAfee is supposed to have fixed the issue, at least in my case I was able to download it after McAfee released this information. I would update your antivirus software and try again. If this does not work, then I will use the version you are running. The new version gives us some fixes plus a look at the 020 items which is WinLogon. If you can't download after you update McAfee, then complete the balance of the instructions and post the log you can. Thanks…pskelley

Here are the results of the panda scan… Incident Status Location Spyware:Spyware/BargainBuddy No disinfected Windows Registry Spyware:Spyware/Dyfuca No disinfected C:\Program Files\Internet Optimizer Adware:Adware/WinTools No disinfected C:\WINDOWS\UnstSA2.exe Spyware:Spyware/TVMedia No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Application Data\tvm*.dll Adware:Adware/IPInsight No disinfected C:\DOCUME~1\CMGREG~1.EAG\LOCALS~1\Temp\alchem.??? Adware:Adware/BlazeFind No disinfected C:\WINDOWS\?_?_?BrowserHelper?.dll Adware:Adware/TopRebates No disinfected C:\DOCUME~1\CMGREG~1.EAG\LOCALS~1\Temp\jkill.exe Spyware:Spyware/LocalNRD No disinfected C:\WINDOWS\inf\localNRD.inf Adware:Adware/Twain-Tech No disinfected C:\DOCUME~1\CMGREG~1.EAG\LOCALS~1\Temp\THI*.tmp Adware:Adware/WUpd No disinfected C:\Program Files\Windows SyncroAd Adware:Adware/Kingporn No disinfected Windows Registry Adware:Adware/DownloadPlus No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Start Menu\Programs\Startup\Download Plus.lnk Adware:Adware/Transponder No disinfected C:\DOCUME~1\CMGREG~1.EAG\LOCALS~1\Temp\alchem.exe Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.cab Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.cab[alchem.inf] Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.cab[alchem.exe] Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.cab[alchem.ini] Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.exe Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.inf Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\alchem.ini Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\conscorr.cab[conscorr.inf] Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\conscorr.cab[conscorr.exe] Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\conscorr.cab[conscorr.ini] Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\conscorr.exe Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\conscorr.inf Adware:Adware/IPInsight No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\conscorr.ini Spyware:Spyware/TVMedia No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\i99.tmp Spyware:Spyware/BetterInet No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\ln_reco.exe Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2AB9.tmp\preInsTT.exe Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2AB9.tmp\twaintec.dll Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2AB9.tmp\twaintec.inf Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\preInsTT.exe Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.cab Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.cab[twaintec.inf] Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.cab[twaintec.dll] Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.cab[preInsTT.exe] Virus:Trj/Downloader.GK No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.cab[polall1m.exe] Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.dll Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI2B3C.tmp\twaintec.inf Spyware:Spyware/LocalNRD No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNrd.cab Spyware:Spyware/LocalNRD No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNrd.cab[localNrd.inf] Spyware:Spyware/LocalNRD No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNrd.cab[localNRD.dll] Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNrd.cab[preInsln.exe] Virus:Trj/Downloader.GK No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNrd.cab[polall1l.exe] Spyware:Spyware/LocalNRD No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNRD.dll Spyware:Spyware/LocalNRD No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\localNrd.inf Virus:Trj/Downloader.GK Disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\polall1l.exe Adware:Adware/Twain-Tech No disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI341.tmp\preInsln.exe Virus:Trj/Downloader.OU Disinfected C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\THI842.tmp\wupdt.exe Adware:Adware/WUpd No disinfected C:\Program Files\backups\backup-20050110-074700-461.inf Adware:Adware/DownloadPlus No disinfected C:\Program Files\Windows Media Player\wmplayer.exe.tmp Adware:Adware/WUpd No disinfected C:\Program Files\Windows SyncroAd\CComm.dll Adware:Adware/WinTools No disinfected C:\WINDOWS\2_0_1browserhelper2.dll Adware:Adware/IPInsight No disinfected C:\WINDOWS\INF\alchem.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\INF\conscorr.inf Spyware:Spyware/LocalNRD No disinfected C:\WINDOWS\INF\localNrd.inf Adware:Adware/Twain-Tech No disinfected C:\WINDOWS\INF\twaintec.inf Adware:Adware/WinTools No disinfected C:\WINDOWS\Key2.txt Spyware:Spyware/LocalNRD No disinfected C:\WINDOWS\localNRD.dll Adware:Adware/Twain-Tech No disinfected C:\WINDOWS\preInsln.exe Adware:Adware/Twain-Tech No disinfected C:\WINDOWS\preInsTT.exe Adware:Adware/IEPageHelper No disinfected C:\WINDOWS\SYSTEM32\commcoss.dll Virus:Trj/Downloader.GK Disinfected C:\WINDOWS\SYSTEM32\polall1m.exe Adware:Adware/BlazeFind No disinfected C:\WINDOWS\UnstSA2.exe Spyware:Spyware/Dyfuca No disinfected C:\WINDOWS\wsem302.dll

Hi in2bud, I will not need the complete log from the free online scans unless I specifically ask for it, rather just feedback as to what it located and if it could not fix something…the complete name and path of such items. I do need the new HJT log with v1.99.1 hopefully. Thanks…pskelley

New Log….bump

You are running HJT twice, see this:

C:\Documents and Settings\cmgreg.EAGLEROCK\Desktop\HijackThis.exe

C:\Documents and Settings\cmgreg.EAGLEROCK\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

You need to delete the one running from the temporary zip file. Make sure the one running from the Desktop has a folder around it. Right click on a blank spot and make a NEW FOLDER, move HJT.Exe and any backups or logs into the folder also, get rid of any version outside of that folder.

This: C:\WINDOWS\System32\wocremmx.exe is some kind of trojan, must be removed, the two 06 items are IE restrictions. if you did not set them or do not want them, you may check and remove them.

Scan with HijackThis and put a check in the box in front of these line items:

O4 - HKLM\..\Run: [qvzypkdp] C:\WINDOWS\System32\wocremmx.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close all programs but HJT and all browser windows then click "Fix Checked"

Use the instructions in the following link to enable hidden files for your Operating System:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT click on Start then click on Explore. Locate and delete this file:

C:\WINDOWS\System32\wocremmx.exe >>> file

Empty the recycle bin and restart the computer. Post a new log, keep in mind I am a volunteer.

Thank you for the extra effort on this one. Here is the latest log…

You are certainly welcome. This log looks clean, how is the computer running? Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

If everything is running ok, you are good to go. The above information will go a long way towards keeping you clean. If you want to take a look at what else is running on the computer that you may not need at startup or may not need at all, these links will help you do that:
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
http://www.pacs-portal.co.uk/startup_index.htm
http://computercops.biz/StartupList.html
http://www.sysinfo.org/startuplist.php
http://www.bleepingcomputer.com/startups/

Good luck and safe surfing
Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you get help here consider a donation:
http://tomcoyote.com/donate.php
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.

pskelly, i cannot send or receive email in outlook… we reintalled and when i try to open a message it gives the error message: "The item cannot be opened. Access is denied. Make sure the disk is not full or write - protected and that the file is not being used." This is the main reason i started posting my logs … outlook kept giving me error messages…