What do I delete?

You've developed a new problem….

Let's see if the "easy" way will work….

We need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft AntiSpyware.
• Click on Options, Settings.
• In the left pane, click on Real-time Protection.
• Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
• Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
• After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
• Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

After all of the fixes are complete it is very important that you enable Real-time Protection again.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\s4psd4.exe reg_run

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of these noted file(s)/FOLDER(s) you can find:

c:\windows\system32\s4psd4.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

ogfile of HijackThis v1.99.1
Scan saved at 9:15:12 PM, on 8/16/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Verizon Online\bin\mpbtn.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\s4psd4.exe reg_run
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} (Verizon Broadband Toolbar) - http://www2.verizon.net/micro/vol_toolbar/vzbb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120219649179
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/…rCabInstall.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

So much for the "easy way"….



You've got the Qoologic Trojan….

Download FindQoologic-Narrator.zip save it to your Desktop.
http://forums.net-integration.net/index.ph…=post&id;=134981

Extract (unzip) the files inside into their own folder called FindQoologic.
Open the FindQoologic folder. Preferable to your desktop.
Locate and double-click the Find-Qoologic.bat file to run it.
wait until a text opens, post it in a reply to your thread.

It may take me a while to filter the "good, bad, and the ugly", so don't hold your breath until my next reply….

Before you do the things in my last post, try running your resident antivirus.

It's supposed to nuke the critter:

Adware.QoolAid

If this entry returns:

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\s4psd4.exe reg_run

(or anything with reg_run at the end)

Then go ahead with the instructions in my last post.

Sorry, I did the first instructions before I saw your last. PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. some examples are MRT.EXE NTDLL.DLL. »»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» * web-nex C:\WINDOWS\System32\DATADX.DLL * web-nex C:\WINDOWS\System32\EOAEB.DLL * web-nex C:\WINDOWS\System32\FKSFGKD.DLL * winsync C:\WINDOWS\System32\DATADX.DLL * winsync C:\WINDOWS\System32\EOAEB.DLL * winsync C:\WINDOWS\System32\FKSFGKD.DLL * rec2_run C:\WINDOWS\System32\DATADX.DLL * web-nex C:\WINDOWS\MHNMK.DLL * conres.cpl C:\WINDOWS\System32\CONRES.CPL * datadx.dll C:\WINDOWS\System32\DATADX.DLL »»»»»»»»»»»»»»»»»»»»»»»» Packed files »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» * UPX! C:\WINDOWS\System32\EETU.EXE * UPX! C:\WINDOWS\ICONT.EXE * UPX! C:\WINDOWS\RU.EXE * aspack C:\WINDOWS\System32\MRT.EXE »»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» * exe C:\docume~1\alluse~1\startm~1\programs\startup\RPAR.EXE »»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»» (fstarts by IMM - test ver. 0.001) NOT using address check – 0x77f7ecc3 Global Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup . .. desktop.ini Microsoft Office.lnk rpar.exe Verizon Online Support Center.lnk User Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup . .. desktop.ini

One more question, how do you think this keeps happening to me? I just got rid of all the spyware" and then something comes back the next day, is it that common or am I doing something I shouldn't? Thanks!!!

Download Killbox from here:

Killbox.zip

Unzip it, but don't run it yet.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\s4psd4.exe reg_run

Then click "Fix checked and close Hijack This!.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

C:\WINDOWS\System32\s4psd4.exe
C:\WINDOWS\System32\DATADX.DLL
C:\WINDOWS\System32\EOAEB.DLL
C:\WINDOWS\System32\FKSFGKD.DLL
C:\WINDOWS\MHNMK.DLL
C:\WINDOWS\System32\CONRES.CPL
C:\WINDOWS\System32\EETU.EXE
C:\WINDOWS\ICONT.EXE
C:\WINDOWS\RU.EXE
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RPAR.EXE

Run Killbox.

In Killbox select "Delete on Reboot".

Click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new log file into this thread.

As far as keeping infections away, have you installed IE-Spyad?

Have you done the browser check as Qualsys?

Have you told other users of the machine to NOT download/install things without checking with you first?

You are WAY BEHIND on Windows updates:

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

That's not going to help.

Great job!!!!

Qoologic is dead!!!

You should create a clean restore point now.

Go to:

Start -> All Programs -> Accessories -> System Tools -> System Restore

And create a restore point.

M68

You guys are the best!!!! I want to see if I can keep this from happening again, where do I install IE Spyad and Qualsys? Also, how can I make sure I always have the latest updates from Microsoft? Thank You Again So Much!!!!!

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check and adjust your IE browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Windows Update

You don't have SP2 installed yet, here's a page about it:

All About XP SP2

You should check out everything about it, and order the CD (it's free - I got mine in about a week).

There is a web page about programs known to have problems with SP2:

Known SP2 Problems

If you have any of those programs, you should probably wait a while before installing SP2.

Another thing you should do is come back here and post another log file before installing SP2 just to be sure you have no malware.

I am trying to find out how to intstall IE spyad - I am currently using Mozilla, will this still work for me?

IE-Spyad doesn't work for Mozilla. If the only thing you're ever going to use IE for is windows updates, installing IE-Spyad probably shouldn't be done because you'd get nothing from it.

What should I do to protect myself if I am using Mozilla?

As far as I can determine, Mozilla "is what it is". Meaning, it's about as "secure" as it will be. You would just have to periodically check for updates.

If you're using Firefox, that would be under:

Tools –> Options –> Advanced

Then click the Check now button under Software updates