Mikarn & Prui will not go away

Need to use computer today. Will run rkfiles and fixme files later tonight and post logs. Will not reboot until you advise then. The attached log is from the ewido install and scan for your reference. ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 11:16:45 AM, 5/14/2005 + Report-Checksum: 52612515 + Date of database: 5/14/2005 + Version of scan engine: v3.0 + Duration: 47 min + Scanned Files: 179287 + Speed: 63.09 Files/Second + Infected files: 95 + Removed files: 95 + Files put in quarantine: 95 + Files that could not be opened: 0 + Files that could not be cleaned: 0 + Binder: Yes + Crypter: Yes + Archives: Yes + Scanned items: C:\ + Scan result: C:\Documents and Settings\Mom & Dad\Cookies\mom & [removed][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Cookies\mom & dad@adknowledge[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Cookies\mom & dad@geocities[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Cookies\mom & dad@p[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Cookies\mom & [removed][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Cookies\mom & dad@search123[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\BGG\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\CDF\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\EJY\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\OWT\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\SFG\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\SFN\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\TLV\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\VRB\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Documents and Settings\Mom & Dad\Local Settings\Temp\XQR\aurareco.exe -> Spyware.BetterInternet -> Cleaned with backup C:\Program Files\MySearch\bar\1.bin\NPMYSRCH.DLL -> Spyware.MyWay.j -> Cleaned with backup C:\Program Files\MySearch\bar\1.bin\S42NS.EXE -> Spyware.MyWay.j -> Cleaned with backup C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL -> Spyware.MyWay.j -> Cleaned with backup C:\Program Files\Support Software\SS2.DLL -> Spyware.MediaPops.a -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP17\A0005405.exe -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP17\A0005406.dll -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP18\A0005425.dll -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP18\snapshot\MFEX-3.DAT -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP28\A0010755.dll -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP28\A0010756.dll -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP28\A0010757.dll -> Spyware.Small.et -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP28\A0010759.exe -> TrojanDownloader.Qoologic.i -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP28\A0010760.cpl -> TrojanDropper.Win32.Small.wc -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP28\A0010761.exe -> TrojanDropper.Win32.Small.wc -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010957.exe -> Spyware.ConsCorr -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010958.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010959.exe -> Trojan.Nail -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010960.exe -> Trojan.Stervis.c -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010961.exe -> TrojanDownloader.Apropo.r -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010963.exe -> Spyware.MediaPass -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010964.dll -> Spyware.Beginto.c -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010965.exe -> Spyware.180solutions -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010966.EXE -> TrojanDropper.Small.wd -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010967.exe -> Spyware.Beginto.c -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010968.exe -> Trojan.Registrator.b -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010969.exe -> Spyware.WinAD.ab -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010970.exe -> Spyware.180solutions -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010971.EXE -> TrojanDropper.Small.wd -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010972.exe -> Spyware.Beginto.c -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010974.dll -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010975.dll -> Trojan.Agent.db -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010980.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP30\A0010991.exe -> Trojan.Nail -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP31\A0010994.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP31\A0011001.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP31\A0011011.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP31\A0011025.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP31\A0011026.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP31\A0011032.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP32\A0011044.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP33\A0011048.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP33\A0011051.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP33\A0012029.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP33\A0012030.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP34\A0012042.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP35\A0012056.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP35\A0012070.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP35\A0012073.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP35\A0012075.dll -> Trojan.Agent.db -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP35\A0012082.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP36\A0012102.exe -> Trojan.Stervis.c -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP36\A0012103.exe -> Trojan.Nail -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP36\A0012105.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP37\A0012110.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP37\A0013095.exe -> Trojan.Agent.cp -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP37\A0013101.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP4\A0003067.exe -> Spyware.BetterInternet -> Cleaned with backup C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP8\A0004300.exe -> TrojanDownloader.Intexp.c -> Cleaned with backup C:\WINDOWS\backup-20040918-113324-550.dll -> Spyware.Midadle.b -> Cleaned with backup C:\WINDOWS\dhp2.dll -> Spyware.DealHelper.j -> Cleaned with backup C:\WINDOWS\Downloaded Program Files\PrevAdX.dll -> Spyware.WinAD.f -> Cleaned with backup C:\WINDOWS\Helper101.dll -> Spyware.Delf.r -> Cleaned with backup C:\WINDOWS\msiexec.exe -> Backdoor.Agent.jn -> Cleaned with backup C:\WINDOWS\Nail.exe -> Trojan.Nail -> Cleaned with backup C:\WINDOWS\save.exe -> Spyware.SaveNow.z -> Cleaned with backup C:\WINDOWS\svcproc.exe -> Trojan.Stervis.c -> Cleaned with backup C:\WINDOWS\SYSTEM32\axuninstall.exe -> Spyware.BlazeFind.e -> Cleaned with backup C:\WINDOWS\SYSTEM32\Cache\cxtpls_loader.exe -> TrojanDownloader.Apropo.ab -> Cleaned with backup C:\WINDOWS\SYSTEM32\Cache\installer_MARKETING17.exe -> TrojanDownloader.Adload.a -> Cleaned with backup C:\WINDOWS\SYSTEM32\Cache\MTE0MzA6ODoxMg.exe -> Spyware.ISearch.d -> Cleaned with backup C:\WINDOWS\SYSTEM32\Cache\thin-8-3-x-x.exe -> Spyware.BetterInternet -> Cleaned with backup C:\WINDOWS\SYSTEM32\Cache\trafficgen-fran.exe -> Spyware.HotSearchBar.d -> Cleaned with backup C:\WINDOWS\SYSTEM32\Cache\VCM2 Qinstaller 282_190.exe -> TrojanDropper.Win32.Small.wc -> Cleaned with backup C:\WINDOWS\SYSTEM32\javex80.vxd/C:/WINDOWS/System32/nvms.dll -> Spyware.Bargainbuddy -> Cleaned with backup C:\WINDOWS\SYSTEM32\javex80.vxd/C:/Program Files/NaviSearch/bin/nls.exe -> Spyware.ExactSearchBar -> Cleaned with backup C:\WINDOWS\SYSTEM32\psis80ex.ax/C:/WINDOWS/System32/mscb.dll -> Spyware.BargainBuddy.i -> Cleaned with backup C:\WINDOWS\SYSTEM32\psis80ex.ax/C:/Program Files/CashBack/bin/cashback.exe -> Spyware.BargainBuddy -> Cleaned with backup C:\WINDOWS\SYSTEM32\psis80ex.ax/C:/Program Files/CashBack/bin/cb.exe -> Spyware.CashBack.b -> Cleaned with backup C:\WINDOWS\SYSTEM32\psis80ex.ax/C:/Program Files/CashBack/bin/flash.exe -> Spyware.CashBack.d -> Cleaned with backup C:\WINDOWS\SYSTEM32\__delete_on_reboot__DrPMon.dll -> Trojan.Agent.db -> Cleaned with backup ::Report End

1. Run Ewido. Click Scan – Start. When the scan is completed click the middle button (Something like “save log”) and save this log to your desktop.

2. Run the fixme.reg you created earlier.

3. Run Killbox.
Select the option "Delete on reboot".

Now copy the next bold:

C:\WINDOWS\SYSTEM32\msdjgk.dll
C:\WINDOWS\SYSTEM32\msfaol.dll
C:\WINDOWS\SYSTEM32\msiaih.dll
C:\WINDOWS\Nail.exe
C:\WINDOWS\svcproc.exe
C:\WINDOWS\del.tmp

Open 'file' in the killboxmenu on top and choose Paste from clipboard

Now you will see, this is pasted in the "Full Path of File to Delete"-field.
There's a little arrow (dropdown-arrow) next to that field.
If you expand it, these lines must be there together!

Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be deleted on next reboot.. Click YES
When it asks if you would like to Reboot now, click NO.

4. Reboot now AGAIN INTO SAFE MODE!

5. Run HijackThis (“Do a system scan only”), and fix these lines (if present):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O4 - HKLM\..\RunServices: [The Intranet] intranet.exe
O4 - HKCU\..\Run: [The Intranet] intranet.exe
O4 - HKCU\..\RunServices: [The Intranet] intranet.exe

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

6. Now reboot into normal mode.

7. Make a new log with HijackThis, and post it here.

Please download Nailfix from here:
http://users.pandora.be/bluepatchy/nailfix.zip
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.bat. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Then please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log.

Hans,

After the posting I just made, I did a seach for Nail.exe in the resolved HJT forum and found this link. Should I download this and execute the .bat file in the Safe Mode?


Please download Nailfix from here:
http://users.pandora.be/bluepatchy/nailfix.zip
Unzip it to the desktop but please do NOT run it yet.

See my post above yours

Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme.reg (save as: all files) and save it on your Desktop.

REGEDIT4 

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_IntranetService]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\IntranetService]

Locate fixme.reg on your Desktop and double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer "Yes" and wait for a message to appear similar to "Merged Successfully".


———

You've got the Peper Trojan.

First download the fix for the Peper Trojan at:
http://downloads.subratam.org/PeperFix.exe
-Double click on Peperfix.exe
-click: Find and fix button
-Reboot when prompted

Run Peperfix.exe tool one more time and reboot.

Now post a new logfile here please

Hi Rio,

1. Run HijackThis (“Do a system scan only”). Put a checkmark near these lines:

O4 - HKLM\..\Run: [The Intranet] intranet.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\SYSTEM32\AAU4ZY.EXE

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU) >> See the note below

NOTE
I noticed you've got an entry of wheatherbug present in your log… Do you use it on purpose or haven't you ever heard of it? If not, check it too in HiJackThis… If you do have it on purpose, decide if it's worth keeping it… It's considered malware…

2. Close all other windows and browsers, and hit Fix Checked.

3. Reboot into safe mode by tapping F8 frequently during bootup.
Make sure your settings allow you to view "Hidden files". Open up any explorer windows and click on "Tools" => "Folder Options" => "View" and be sure to check off "Show Hidden Files and Folders".

4. Delete, in safe mode:
Folder
C:\Program Files\AWS << folder, only if you've fixed the O9 from Weatherbug, see the note above

File
C:\WINDOWS\SYSTEM32\AAU4ZY.EXE

5. Reboot into normal mode, make a new HijackThis log, and post it here

Reboot again and let me know if the dialogbox comes back…

Looks good!

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers real-time protection from spyware installation attempts.
• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer

I also suggest that you delete your Temp folders regularly. Use CleanUp! to do this automatically for you!