What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis Log For Jerseycityjim

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Below is my HijackThis log. My computer has been overrun with adware and spyware. I have updated versions of Norton Anitvirus, AdAware SE, CWShredder, Microsoft AntiSpyware, Spybot- S&D, and AdAway. After a long battle, I thought I had gotten everything clean but everyday new files start showing up. I'm afraid the programs are missing something. A friend recommended your site and I thought I would give it a try.


Logfile of HijackThis v1.98.2
Scan saved at 7:48:48 AM, on 4/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\brsvc01a.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\brss01a.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Documents and Settings\Administrator\Desktop\Virus Programs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\suo.a00988\InstallStub.exe -r
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O16 - DPF: {886DDE35-E955-11D0-A707-000000521958} - http://69.56.176.78/webplugin.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.salisbury.edu/activex/AxisCamControl.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O16 - DPF: {886DDE35-E955-11D0-A707-000000521958} - http://69.56.176.78/webplugin.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.salisbury.edu/activex/AxisCamControl.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab


Thanks
James
Post #2 last edited
Hello James, Welcome to TomCoyote forum. If you still need some help, I will see what I can do. First the item causing your problems is called IEPlugin. This is an ActiveX called a Downloaded Program File. It is in your 016 items in the log. There are two of these programs running and they look alike and must be both removed. While you are removing them you may look at all DPF 016 items and check for removal any you no longer use or do not know what they are. Only the 016. If you should make a mistake and remove a good one you will be prompted to install it again the next time you visit the site. In this link you can read about this malware:
http://www.spywareguide.com/product_show.php?id=482

1) You are running an old version of HJT, we are currently working log with version 1.99.1, and there very well may be items I can't see until you post a new log. Please update from here: http://www.malwareremoval.com/downloads.html and use the new version, 1.99.1 when you post your next log.

2) You have called the folder for HijackThis.exe "Virus Programs". I have no objection to the name but it must be used exclusively for HJT.exe, logs and backups. Do not store anything else in this folder. Thanks.

3) Download CCleaner from this link: http://www.ccleaner.com/ Take the time to review the instructions on the download page so that when I ask you to run it you will know what you are doing.

4) Microsoft AntiSpyware: This product may interfere with the HJT fix we must make, you can try it first to see or you can disable it before you remove the bad stuff…your option.
To disable the program, follow the instructions below:
A.) Right click on the Microsoft Antispyware tray icon (a little red and yellow circle looking thing)
B.) Click on Security Agents Status (Enabled)
C.) Click on Disable Real-time Protection.

5) Because these items got in via ActiveX I am giving you information I usually save for after you are clean, so you can review the information and take steps to block that security breach:
http://www.bleepingcomputer.com/forums/topict2520.html

6) Open Hijack this and choose "Do a system scan only" then check the box in front of these line items:

O16 - DPF: {886DDE35-E955-11D0-A707-000000521958} - http://69.56.176.78/webplugin.cab
-IEPlugin
O16 - DPF: {886DDE35-E955-11D0-A707-000000521958} - http://69.56.176.78/webplugin.cab
-IEPlugin

Close all programs but HJT and all browser window, then click on "Fix Checked"

Run CCleaner then restart the computer and post a new log in this same thread along with any feedback you have.

Thanks…pskelley
TomCoyote forum
Slyware Warrior

PURGE SYSTEM RESTORE
When you are completely finished with the removal procedure and are satisfied that the threat has been removed follow these instruction:
http://service1.symantec.com/SUPPORT/tsgen…src=sec_doc_nam
Post #3
Thank you so much for the detailed instructions to help me out. I've gone through all of the items you outlined and here is the updated log file. Please let me know if I need to do anything else.

Logfile of HijackThis v1.99.1
Scan saved at 11:27:25 PM, on 4/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\brsvc01a.exe
C:\WINNT\System32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\suo.a00988\InstallStub.exe -r
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #4
Hi Jim, Log was looking perfect until I got to the new items which are Services that malware writers also use to infect computers. By the way, great job following the instructions now I will need a little help with this one. Here is what it looks like.
O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE To start with, if you know what this is I would appreciate it if you would give me a little information so I can have it added to our databases. I have not seen this item before and I should also suggest if you ran CCleaner in the default mode it should have cleaned out the c\windows\temp folder. I will show you what my search has located.
When I search Google for: O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE I am told this: Your search - O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE - did not match any documents.
When I search Google for: c:\windows\temp\FireDaemon.EXE I get this information: Your search - c:\windows\temp\FireDaemon.EXE - did not match any documents
When I search Google for: FireDaemon.EXE: This information is returned:
http://vil.nai.com/vil/content/v_100054.htm and the balance of the Google
http://www.liutilities.com/products/wintas…ary/firedaemon/
and the balance of the Google information on this on:
http://www.google.com/search?sourceid=navc…ireDaemon%2EEXE
I am 99% certain this item was added by a trojan and it should be removed. I will give you information to remove it and unless you know what it is that is what we will do. As I said, if CCleaner cleaned out the temp folder the only thing left is the log line and the item is gone. I just want you to be assured you are removing something bad so I try to look at all possibilities. If the item is still in the temp folder you can right click it and check it's properties as a final check.

Open Hijack this and choose "Do a system scan only" then check the box in front of these line items:

O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE

Close all programs but HJT and all browser windows, then click on "Fix Checked"

If you have not done so by now, and the item is still in the c:\windows\temp\FireDaemon.EXE >>> file delete it.

Look at a new log, if is gone, post that log for me, if it is still showing in Services, here are a couple of things you can try to remove the Services line:

http://www.ss64.com/ntsyntax/services.html
http://www.z123.org/techsupport/xpservices.htm

Some information about services that may help you.
http://www.blackviper.com/WinXP/servicecfg.htm

Thanks…pskelley
Post #5 last edited
Hello Jim, Hold those last instructions, it appears you have what is called a xdcc rootkit infection. Once of our experts spotted this and we will be learning about it together. Experts may be posting into the thread. Here is what you will need to do.
Download the free trial version of TDS-3 from here: http://tds.diamondcs.com.au/ Update the product when it is down. Allow a desktop shortcut for ease of working. Follow the instructions. Once updated double click on the desktop icon. The software will run, allow it to finish. Here is where I got off as I had no trojan to test it on. I am waiting for additional instuctions but I know you will be notified at that point if anything is found. If as a result of something be located you are asked if you want to remove the trojan, please say yes. If not, post the information for me. Seems you can't copy/paste from the interface, but I found you could click on TDS in the left corner then click on save. Another line will be added indicating it was saved to C:\Program\TDS3\scr1.txt, this is if you allowed the download to "RUN" the default location. If we need the log you can copy and past from this .txt file = scr1.txt
Let me know what happens when you run the program. Thanks…pskelley
Post #6
I actually went and did the 6:24 AM post this morning prior to the second post. I didn't reply right away because I couldn't get the FireDaemon line to delete. I still can't get the line to delete. I did go in and delete the files and the updated log now says the files are missing but I haven't noticed a change in the computer either good or bad. I'll post both the log from the HijackThis and TDS-3. I downloaded the TDS-3 program, updated the datebase and ran it but no trojans were found.

HijackThis Log
Logfile of HijackThis v1.99.1
Scan saved at 7:20:01 PM, on 4/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\brsvc01a.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\brss01a.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINNT\system32\wscntfy.exe
C:\PROGRA~1\SPYWAR~2\swdoctor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\suo.a00988\InstallStub.exe -r
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

TDS-3 Log
19:05:40 [Init] Trojan Defence Suite v3.2.0 (UNLICENSED)
19:05:40 [Init] Started 11-04-05 19:05:40 Eastern Standard Time (UTC: 5), Internet Time @1003.94
19:05:40 [Init] Loading TDS-3 Systems …
19:05:40 [Init] Token successfully adjusted.
19:05:40 [Init] • TDS Privileges : OK. Adjusted TDS-3 token privileges to maximum
19:05:41 [Init] • Plugins : OK. Loaded 13
19:05:41 [Init] • Exec Protection : Not Installed
19:05:41 [Init] WARNING: Your Radius.TD3 database needs to be updated!
19:05:41 [Init] Please download the latest from http://tds.diamondcs.com.au/radius.td3
19:05:41 [Init] Licensed users can use the Update facility from the TDS menu
19:05:41 [Init] Loading Radius Advanced Scanning Systems …
19:05:50 [Init] • Radius Advanced Specialist Extensions on standby for 13 trojan families
19:05:50 [Init] • Systems Initialised [39471 references - 16560 primaries/10873 traces/12038 variants/other]
19:05:50 [Init] Radius Systems loaded.
19:05:50 [Init] TDS-3 Ready.
19:05:50 [Tip Of The Day] DiamondCS have released many utilities and applications to the global Internet community as FREEWARE! You can download these programs from http://www.diamondcs.com.au
19:05:50 [TDS] Good evening Administrator.
19:05:55 [Mutex Memory Scan] Started…
19:06:00 [Mutex Memory Scan] Finished (no trojan mutexes found).
19:06:00 [TDS-3] This is an EVALUATION demo of TDS-3. Please see the help file for help on registering.
19:07:24 [Quit] Unloading …
19:09:02 [Init] Trojan Defence Suite v3.2.0 (UNLICENSED)
19:09:02 [Init] Started 11-04-05 19:09:02 Eastern Standard Time (UTC: 5), Internet Time @1006.27
19:09:02 [Init] Loading TDS-3 Systems …
19:09:02 [Init] Token successfully adjusted.
19:09:02 [Init] • TDS Privileges : OK. Adjusted TDS-3 token privileges to maximum
19:09:03 [Init] • Plugins : OK. Loaded 13
19:09:03 [Init] • Exec Protection : Not Installed
19:09:03 [Init] WARNING: Your Radius.TD3 database needs to be updated!
19:09:03 [Init] Please download the latest from http://tds.diamondcs.com.au/radius.td3
19:09:03 [Init] Licensed users can use the Update facility from the TDS menu
19:09:03 [Init] Loading Radius Advanced Scanning Systems …
19:09:13 [Init] • Radius Advanced Specialist Extensions on standby for 13 trojan families
19:09:13 [Init] • Systems Initialised [51923 references - 26383 primaries/13324 traces/12216 variants/other]
19:09:13 [Init] Radius Systems loaded.
19:09:13 [Init] TDS-3 Ready.
19:09:13 [Tip Of The Day] Did you know? - DiamondCS are the only anti-trojan company that updates DAILY.
19:09:13 [TDS] Good evening Administrator.
19:09:19 [Mutex Memory Scan] Started…
19:09:21 [Mutex Memory Scan] Finished (no trojan mutexes found).
19:09:21 [TDS-3] This is an EVALUATION demo of TDS-3. Please see the help file for help on registering.
19:12:04 [Screen Text] Saved to C:\Program Files\TDS3\scr0.txt
19:12:23 [Screen Text] Saved to C:\Program Files\TDS3\scr1.txt


If I haven't said this prior…THANK YOU. Your help is incredible and I really appreciate it.

Jim
Post #7
Hello Jim, Of course you are aware this item is still in the log. The expert who is familiar with the removal of this item is I believe down under, so that is going to make communication difficult. I was emailing him at work today and he gave me a good bit of information, but I was assuming this item would show up in that scan and now I need to wait until he gets back to me. The first thing I noticed is that the TDS-3 was not updated prior to running:
19:05:41 [Init] WARNING: Your Radius.TD3 database needs to be updated!
19:05:41 [Init] Please download the latest from http://tds.diamondcs.com.au/radius.td3

While I am learning this software, I did install it on one of my computers and I noticed the important thing to updating is that you must right click and "save target as" making sure you save it in the same folder. It will ask if you want to replace the one that is there..say yes. If you can delete the two .txt files that are here:
19:12:04 [Screen Text] Saved to C:\Program Files\TDS3\scr0.txt
19:12:23 [Screen Text] Saved to C:\Program Files\TDS3\scr1.txt

So they will not get in your way. After you successfully update the program, please run it again to make sure nothing is there. I have given you as much information as I have at this point. I will wait for a look at the next run of TDS-3 and I will post information as soon as I get it. There are other methods for killing this item, I just want to be sure I am proceediung correctly and the time difference will slow us down. Anything you wish to try on your end is fine by me, just don't blow up the computer.
Once again as soon as I have information I will post it.
Thanks…pskelley
Post #8
Hi Jim, I have not heard from you since Apr 11 2005, 06:24 PM. I have additional information, it seems the Mutex Memory Scan is only one portion of the overall scan. Please let us know if your issue has been resolved so I can close the thread. I have this information for you:

on the top bar of tds-3 console window click system testing: full system scan

he must do all scans in the scanmenu, those are set there by default( mutex, trace, procss file , process memory etc)

the mutex scan only finds trojans with memory mutexes ( usually a mutex is created to ensure that only one copy of the trojan will run in memory at the same time> preventing the stealing of victims… )

i'd say we're on the right track because no legitimate service will ever be running from c:\windows\temp :)


Thanks…pskelley
Post #9
Sorry for my delay. I had a minor car accident on Monday and with all of the hassle (insurance, setting up rapair, etc), I've been a little preoccupied. Last night I pulled down the updates again for the TDS3. I did notice that since I have to do the manual update, it mentions on the web site that the log will say that it is not updated when in fact it is. I poked around the program for a bit and did find the full scan option. I ran it and it found about 20 trojans on the machine which I then was able to delete. When I get home tonight, I will run the scan again and post the log file for both TDS3 and HijackThis for you to review. Thanks Jim
Post #10
Hey Jim, sorry to hear about these problems and don't be concerned about TC, we will be here when you need us and do all we can to help. I was just concerned that you were waiting for me to respond. One of our experts with the trojan showing in your services who is from Finland is also watching in and I wanted to make sure this had not occured. I ran TDS-3 on my computer and this was my results just so you can see: Scan Control Dumped @ 11:01:38 13-04-05 Suspicious Filename: Dual extensions File: c:\program files\hewlett-packard\digital imaging\hpis\temp\install.wse.exe Positive identification: Riskware.ProcessRestart File: c:\program files\logitech\desktop messenger\8876480\6.1.4.36-8876480l\program\restart.exe Suspicious Filename: HTA file in suspicious location File: c:\system volume information\_restore{987e0331-0f01-427c-a58a-7a2e4aabf84d}\rp663\a0175275.hta I ruled out as valid the HP item moved the Riskware from logitech to the recycle bin to try the software without it and purged my system restore files to remove an item I cleaned a while back and admit I was not aware I was backing it up. This is a great tool, shame it is not freeware, but it may well be worth the price. pskelley
Post #11
Sorry for my delay in replying. Last week was a bit hectic. Here is the latest HijackThis log. I know there are a few listings for FireDaemon, but I can't seem to get them to delete. Any suggestions?

Logfile of HijackThis v1.99.1
Scan saved at 7:39:57 AM, on 4/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\brsvc01a.exe
C:\WINNT\System32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SpyKiller\spykiller.exe
C:\Program Files\BestPopUpKiller\BestPopupKiller.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINNT\system32\wscntfy.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe -hide
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\suo.a00988\InstallStub.exe -r
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: FireDaemon Service: mirc (mirc) - Unknown owner - c:\windows\temp\FireDaemon.EXE (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: FireDaemon Service: rundll32.exe (rundll32.exe) - Unknown owner - c:\winnt\system32\dcache\data\FireDaemon.EXE (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: FireDaemon Service: svchost.exe (svchost.exe) - Unknown owner - c:\winnt\system32\dcache\data\FireDaemon.EXE (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Thanks again.
Jim
Post #12 last edited
Hi Jim, We will need some information from you as follows:

is this folder visible c:\winnt\system32\dcache\data ?

if it is:

open a command prompt and type the following commands, hit enter after each one:


cd c:\winnt\system32\dcache\data
dir > files.txt

go to the folder c:\winnt\system32\dcache\data
look for files.txt, open it with notepad and post it's contents here
(that could be 2 posts worth of text )

to open a commands prompt:
click start> run >type in the box> cmd


After you do this, would you look in the TDS-3 folder to see if the scan logs are still there. If they are let me know we may want to look at them, will let you know.
Thanks much…pskelley
Post #13
Good Afternoon. I tried to locate the file.txt document without success. I don't even have the dcache file folder. It was deleted previously and it doesn't like it's popped back up. On a similar but separate note, in the quote from the Apr 13 2005, 09:07 AM post, your associate mentioned that no legitimate service will ever be running from c:\windows\temp. I looked in the folder and there are several items in there ranging from a svchost.exe to a aliases config file and several other files. Should these be there? Jim
Post #14
Hey Jim, In case I did not mention it the expert who is assisting lives in Finland and there will be waits at time for communication. He is also notified when you post but would be sleeping now. As soon as possible he will get information to you. You should be aware that we have cleared the Temp stuff, but this infection can morph and reinfect the Temp folder. It appears it needs to run from somewhere, and something, a hidden file or .dll is there somewhere putting it back when we remove it. I guess we should leave the Temp stuff alone until we kill the infection then we can clean out all Temp files, Prefetch files and Purge System Restore at that point.

Here are some links to information about Temp and Prefetch.
http://www.pcmag.com/article2/0,1759,1683520,00.asp
http://techrepublic.com.com/5100-6270-5165773.html
http://www.safecomputing.umn.edu/guides/tempdirectories.html
http://www.personal-computer-tutor.com/deletingtempfiles.htm


You may also want to look over this information:
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
http://www.adwarereport.com/mt/archives/000024.html
My Google search showed many, many negative user comments.

O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
http://castlecops.com/startuplist-5311.html
Popup killer of dubious repute by SwankSoft.com.

Thanks…pskelley
Post #15
OK Jim…Hot of the presses…lol

1) Download and follow the instructions carefully, Killbox from here: http://forum.malwareremoval.com/viewtopic.php?t=320
The line to paste or type into killbox is: c:\winnt\system32\dcache

2) Then manually delete all files inside c:\windows\temp, and all of its subfolders. Should you get any cannot delete, file is in use messages we know our next target. Please post the names of any such file that can't be deleted.
If no trouble in the deletion move to step #3. If you do have to post files then wait for instructions.

3) Let's try to delete those services.

Click Start>Run, type services.msc into the Open: dialog and click the Ok button. In the Services window locate Windows Services (mirc) and click on it to select it. Then click on the Stop button. In the Startup type dropdown choose Disabled. Click the Apply button and then the Ok button.
Next, click Start>Run, type cmd into the Open dialog and click the Ok button. Copy/paste the line below into the command prompt window and press the Enter key:

sc delete mirc


Click Start>Run, type services.msc into the Open: dialog and click the Ok button. In the Services window locate Windows Services (rundll32.exe) and click on it to select it. Then click on the Stop button. In the Startup type dropdown choose Disabled. Click the Apply button and then the Ok button.
Next, click Start>Run, type cmd into the Open dialog and click the Ok button. Copy/paste the line below into the command prompt window and press the Enter key:

sc delete rundll32.exe

Click Start>Run, type services.msc into the Open: dialog and click the Ok button. In the Services window locate Windows Services (svchost.exe) and click on it to select it. Then click on the Stop button. In the Startup type dropdown choose Disabled. Click the Apply button and then the Ok button.
Next, click Start>Run, type cmd into the Open dialog and click the Ok button. Copy/paste the line below into the command prompt window and press the Enter key:

sc delete svchost.exe

4) Assuming we have gotten this far, run this free online scan and post the result log for us. http://www.bitdefender.com/scan/licence.php

Thanks…pskelley

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI