What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

IBIS and Toolbar Removal

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Trying to rid my machine of IBIS and Toolbar which as most people know keeps reappears. I ran Ewido in safe mode and a fresh copy of HJT (based on what I saw instructed in other posts). Here's the resultant files:

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 8:28:47 PM, 8/28/2005
+ Report-Checksum: F182B324

+ Scan result:

C:\Documents and Settings\Herb Salls\My Documents\From Old XP Computer\Carol S\Local Settings\Temporary Internet Files\Content.IE5\654ZUZGV\kwlist7[1].exe -> TrojanDropper.Agent.se : Cleaned with backup
C:\Documents and Settings\Herb Salls\My Documents\From Old XP Computer\Carol S\Local Settings\Temporary Internet Files\Content.IE5\KZKBUD8T\silent_setup[1].exe -> TrojanDropper.Agent.se : Cleaned with backup
C:\RECYCLER\NPROTECT\00026067 -> Spyware.EliteBar : Cleaned with backup
C:\RECYCLER\NPROTECT\00026612.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\RECYCLER\NPROTECT\00026613.TXT -> Spyware.Cookie.Addynamix : Cleaned with backup
C:\RECYCLER\NPROTECT\00026614.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\NPROTECT\00026615.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\RECYCLER\NPROTECT\00026616.TXT -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\RECYCLER\NPROTECT\00026617.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\NPROTECT\00026618.TXT -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\RECYCLER\NPROTECT\00026619.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
C:\RECYCLER\NPROTECT\00026620.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00026621.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\RECYCLER\NPROTECT\00026622.EXE -> Spyware.PurityScan : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 9:35:12 PM, on 8/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\asuskbservice.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\anvshell.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Serials3k\s3k_autoupdate.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Documents and Settings\Herb Salls\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Time Sync] C:\Program Files\Time Sync\time.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [AutoUpdate] C:\Program Files\Serials3k\s3k_autoupdate.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Tbci] C:\Documents and Settings\Herb Salls\Application Data\tsew.exe
O4 - HKCU\..\Run: [Eoby] C:\WINDOWS\system32\j?vaw.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download &All by FD - file://C:\Program Files\FreshDevices\FreshDownload\fdiectx2.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download with &FD - file://C:\Program Files\FreshDevices\FreshDownload\fdiectx.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Open with &ZipScan - C:\PROGRA~1\ZIPSCA~1\zs_ie.htm
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1120082582953
O23 - Service: ASUSKeyboardService - ASUSTeK COMPUTER INC. - C:\WINDOWS\asuskbservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Can anyone tell me what's next, please?

Thanks.
Post #2
Hi Herb and welcome to forums. Sorry for the wait we are extremely busy. Please start by moving HJT.exe off the Desktop where it can store logs and backups for safety. I suggest here: C:\HJT\HijackThis.exe. Here are more detailed instructions if you require them: http://russelltexas.com/malware/createhjtfolder.htm

Let's use these two installers first, review the instructions and run the uninstaller for Purity Scan here:
http://sarc.com/avcenter/venc/data/adware.purityscan.html and adware.websearch here:
http://securityresponse.symantec.com/avcen….websearch.html

1) Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp and please do not run it until I ask you to.

2) Download, update, configure and run these two programs: http://tomcoyote.org/aawsb.php Please do not activate TeaTimer until we are finished with the repair.
The newest version of Ad-aware is 1.06 and Spybot 1.04. Even if you have these programs, use the link to get the newest version, update and configure them as in the link. Run Spybot first, reboot then run Ad-aware. Both programs back up what they remove so delete anything the programs say should be removed.

3) Open Add Remove programs and Uninstall Search Toolbar, TS Toolbar, and WebSearch Toolbar, WinTools, Huntbar, Toolbar or anything that looks like it.

4) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
O4 - HKLM\..\Run: [Time Sync] C:\Program Files\Time Sync\time.exe
see this: http://castlecops.com/t110553-Time_exe_Time_Sync.html
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
HuntBar parasite variant
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
WinTools adware
O4 - HKCU\..\Run: [Tbci] C:\Documents and Settings\Herb Salls\Application Data\tsew.exe
????
O4 - HKCU\..\Run: [Eoby] C:\WINDOWS\system32\j?vaw.exe
PurityScan/Clickspring adware

Close all programs but HJT and all browser windows, then click on "Fix Checked"

5) SHOW HIDDEN FILES: Follow the instructions in the link to enable hidden files for your operating system.
You may wish to reverse this process if you have any concern about anyone getting into these hidden system files.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\Program Files\Time Sync\ >>> folder

C:\PROGRAM FILES~1\Toolbar\ >>> folder

C:\PROGRAM FILES~1\COMMON~1\WinTools\ >>> folder

C:\WINDOWS\system32\j?vaw.exe >>> file

C:\Windows\Prefetch: Locate this folder and delete all of the contents (NOT THE FOLDER) This information will tell you more about Prefetch:
http://www.windowsnetworking.com/articles_…refetch-XP.html

6) Run CCleaner, when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do. Then restart the computer and post a new HJT log in this same thread along with any feedback you have. Let me know how you are running now.

Thanks…pskelley
TomCoyote forum
Slyware Warrior

PURGE SYSTEM RESTORE
When you are completely finished with the removal procedure and are satisfied that the threat has been removed follow these instructions:
http://service1.symantec.com/SUPPORT/tsgen…src=sec_doc_nam
Post #3
OK - pskelly - here's what I hope will be a good bit of progress. By way of feedback, let me say that I ran your instruction set to the "T", very carefully jotting down remarks and checking off at each step of the way. I firmly believe I adhered to the track. Some observations: Steps 1 & 2 went through without much. SB S&D found some instances of DyFusa and a few MRUs and one instance of EliteBar. Took them out. AdAware (fully configured according to the link and triple checked) found 4 Critical Objs and deleted them. Step 4 - I could not find any of the reg keys mentioned so I moved on. Step 5: I browsed with Explorer found none. So I went back and did an Explorer Search for all words individually and found no files or folders to remove. Cleaned out PreFetch. Step 6, CCleaner runs through and finds numerous (tons) of issues related to stray or orphaned .dlls (380 of them). Stripped them out. Rebooting at each phase per instructions BTW. So, here's the latest HJT log. Is there any significance to the fact that I have two instances of svchost.exe running in the "processes" section?

Let me know if you think I can dump the restore points and when it would be good to so I have a fresh clean copy of the system image. Giant AntiSpy will schedule its run tomorrow early so I'll know if IBIS is gone. One thing further - system (an old P-II 850 Mhz Coppermine) actually appears to be a lot peppier! :-)

Thanks again for taking the time to help us all out!

Herb



Logfile of HijackThis v1.99.1
Scan saved at 10:33:02 PM, on 09/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\PROGRA~1\NORTON~1\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Giant Anti-Spyware\gcasServ.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Giant Anti-Spyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QD FastAndSafe] C:\PROGRA~1\NORTON~1\NORTON~3\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Giant Anti-Spyware\gcasServ.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Shareaza] "D:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ProtoWall] D:\dudez\protowall\ProtoWall.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download &All by FD - file://D:\Program Files\Fresh\FreshDownload\fdiectx2.htm
O8 - Extra context menu item: Download with &FD - file://D:\Program Files\Fresh\FreshDownload\fdiectx.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://learn2search.cjb.net
O15 - Trusted Zone: http://*.sourceforge.net
O15 - Trusted Zone: http://www.usaa.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1120083517346
O16 - DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - http://download.divx.com/player/DivXPlayerInstaller.exe
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TU2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
Post #4
Hi Herb, First I need to to check a file for me. I don't think there is anything wrong with it by my scanners are picking it up and I wish to be sure. Here is the file to check: D:\Program Files\Giant Anti-Spyware\gcasDtServ.exe You can check it here:
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustotal.com/flash/index_en.html
Post the results for me please so I can adjust the scanner data base if the file is valid. Thanks.

Is there any significance to the fact that I have two instances of svchost.exe running in the "processes" section?

No, as many instances as are needed will be running, see this: http://support.microsoft.com/?kbid=314056

Question for you. While I have not started suggesting it yet since it is still in the Beta phase, I was wondering why Microsoft does not have you update to the newer product?
http://www.microsoft.com/downloads/details…&displaylang=en

A little P2P information: http://www.spywareinfo.com/articles/p2p/
http://pcpitstop.com/spycheck/p2p.asp
http://pcpitstop.com/spycheck/badtorrent.asp
http://www.mainstream.net/security_howto/d…e_sharing.shtml

I have a tendency to overkill when it comes to this junk. If the uninstallers do their job, then there may be nothing left for HJT to do. Just a double check on my part. We do have more to remove that were not in the first log I viewed and you have also activated Selective Startup in msconfig. I must be able to see all programs. When you post the next log, enable all in msconfig, create a log for me, then you may return to SS without a reboot. Thanks.

(you will probably need to turn off Giant Anti-Spyware, I think it blocks the HJT changes)
Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
(if you placed these restrictions you can leave them, they were not in the first log?)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
(if you do not want this as your Start Page, you can remove it)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
(not in the first log, if you did not allow these in your TZ, check and remove them. I allow NOTHING in my TZ)
O15 - Trusted Zone: http://learn2search.cjb.net
O15 - Trusted Zone: http://*.sourceforge.net
O15 - Trusted Zone: http://www.usaa.com

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Provide me with the information I requested and a HJT log with everything enabled in msconfig for a final check.

Thanks…Phil
Post #5
OK, pskelley - finally had time to sit down with this tonight and follow through. Sorry for the delay - I'm getting the last of the good cycling in before the weather kicks me off the road…

Observation: Giant AntiSpy has run through automatically the last 2 evenings and reported zero (0) infections. No IBIS Toolbar at least.

Answers to questions: Submitted gcasDtServ.exe to all three online scanners. All reported the file clean. I assume that's good news.

Giant AS new beta version? Need to resolve a WGA issue.

Read all information on P2P per suggestion. I run WinMX and Shareza only when I need to. Never ran Kazaa of any ilk, took off LimeWire last year. That's it. End of story.

Checked off almost all HJT suggestions - wanted to keep the homepage intact. Fresh log follows - with everything turned on and Giant turned off.

Thanks very much and I'll be checking in to see what you say.

Logfile of HijackThis v1.99.1
Scan saved at 9:21:17 PM, on 09/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\PROGRA~1\NORTON~1\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SYSTEM32\4b90df.exe
C:\WINDOWS\SYSTEM32\4bed3b.exe
D:\Program Files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Giant Anti-Spyware\gcasServ.exe"
O4 - HKLM\..\Run: [winhlp3.exe] C:\WINDOWS\SYSTEM32\winhlp3.exe
O4 - HKLM\..\Run: [web] C:\WINDOWS\SYSTEM32\4b90df.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [ServiceConfig] "C:\Program Files\Comcast\MigCfg\Programs\IspMig.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [Shareaza] "D:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ProtoWall] D:\dudez\protowall\ProtoWall.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [FUIClearHis] C:\Program Files\FreshDevices\FreshUI\freshui.exe 0 1 2 3 4
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download &All by FD - file://D:\Program Files\Fresh\FreshDownload\fdiectx2.htm
O8 - Extra context menu item: Download with &FD - file://D:\Program Files\Fresh\FreshDownload\fdiectx.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1120083517346
O16 - DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - http://download.divx.com/player/DivXPlayerInstaller.exe
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TU2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
Post #6 last edited
Hello and thanks for the feedback.

Answers to questions: Submitted gcasDtServ.exe to all three online scanners. All reported the file clean. I assume that's good news.

Yes that is good, the data bases on my scanner were updated not too long ago and this appears to be a false positive. I'll use the information you provided to update and keep others from having to check. Make sure you have turned your realtime protection back on.

Giant AS new beta version? Need to resolve a WGA issue.

Not quite sure what you are asking here? The bad news is you have two new items in the log, if you compare the two logs they are not hard to see:
C:\WINDOWS\SYSTEM32\4b90df.exe
C:\WINDOWS\SYSTEM32\4bed3b.exe
My scanners show this to be: Win32/TrojanDownloader.Easto.A TROJAN! You can read about it hear: http://castlecops.com/startuplist-6203.html and see what Tony Klein has to say about the trojan here: http://castlecops.com/postt88486.html
I have no way of knowing if this was there when you scanned for the first log and had not reared it's ugly head yet or if you were just infected with the trojan. You can navigate to the files then right click and check properties for information and a mouseover should tell you the date it was installed.
Here is some information about the trojan: http://www3.ca.com/securityadvisor/pest/pe…px?id=453089426 Since this stuff ius showing up I would like to run some scans to kill it and check to make sure nothing else is lurking around. You also have the links I provided above if you want to check the file before removing it, no doubt in my mind this is a trojan. This would be what I suggest you do.

1) Ewido scan: Make sure you have Ewido configured as in the instructions below, update then run it to see if it will pick up and remove this trojan.
Please download Ewido Security Suite it is a trial version of the program.
  • Install ewido security suite
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

Open Task Manager then the Processes tab, end process on these items if there:
C:\WINDOWS\SYSTEM32\4b90df.exe
C:\WINDOWS\SYSTEM32\4bed3b.exe

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O4 - HKLM\..\Run: [winhlp3.exe] C:\WINDOWS\SYSTEM32\winhlp3.exe
O4 - HKLM\..\Run: [web] C:\WINDOWS\SYSTEM32\4b90df.exe

Close all programs but HJT and all browser windows, then click on "Fix Checked"

SHOW HIDDEN FILES: Follow the instructions in the link to enable hidden files for your operating system.
You may wish to reverse this process if you have any concern about anyone getting into these hidden system files.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\WINDOWS\SYSTEM32\winhlp3.exe >>> file

C:\WINDOWS\SYSTEM32\4b90df.exe >>> file

C:\Windows\Prefetch (clean it out again, not the folder just the contents.)

Run CCleaner Windows, Applications and "Issues" make sure you have the newest version first, one was just released, make sure you backup the registry when prompted if anything needs to be removed.

Post a new HJT log and the Ewido scan results which hopefully will be clean.

I am giving you this information so you can lean from these experts in this malware field: Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

Thanks…Phil
Post #7
OK, Phil - It took a while to get the opportunity to sit down with this thing. The blow-by-blow is as follows. I think we're almost there!
*****
C:\WINDOWS\SYSTEM32\4b90df.exe
C:\WINDOWS\SYSTEM32\4bed3b.exe
These two items are gone - can't see 'em. See HJT log below. Ewido found 133 instances of junk including many entries appearing to be related to Win32/TrojanDownloader.Easto.A TROJAN along with severl dozen cookies that look like they don't belong. Used Ewido to clean them all. It even looked in old archives finding gunk-ware in them. Decided I didn't need those archived copies anyway. Gone.
******
C:\WINDOWS\SYSTEM32\4b90df.exe
C:\WINDOWS\SYSTEM32\4bed3b.exe
These two processes were not in evidence.
******
O4 - HKLM\..\Run: [winhlp3.exe] C:\WINDOWS\SYSTEM32\winhlp3.exe
O4 - HKLM\..\Run: [web] C:\WINDOWS\SYSTEM32\4b90df.exe
These two entries are not found by HJT.
*****
C:\WINDOWS\SYSTEM32\winhlp3.exe >>> file
C:\WINDOWS\SYSTEM32\4b90df.exe >>> file
C:\Windows\Prefetch (clean it out again, not the folder just the contents.)
Searched for the first two. Not found. Cleared out Prefetch.
******
Ran CCleaner. Found very little that I could see.
******
I think I should have rebooted and re-ran everything again but let me follow your instructions literally. and post both logs/reports.

Logfile of HijackThis v1.99.1
Scan saved at 6:34:48 PM, on 09/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
D:\Program Files\Ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\NORTON~1\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\dudez\protowall\ProtoWall.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareUpdater.exe
D:\Program Files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [Shareaza] "D:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ProtoWall] D:\dudez\protowall\ProtoWall.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download &All by FD - file://D:\Program Files\Fresh\FreshDownload\fdiectx2.htm
O8 - Extra context menu item: Download with &FD - file://D:\Program Files\Fresh\FreshDownload\fdiectx.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1120083517346
O16 - DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - http://download.divx.com/player/DivXPlayerInstaller.exe
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\Ewido\security suite\ewidoctrl.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TU2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 5:55:20 PM, 09/17/2005
+ Report-Checksum: 23D1F51C

+ Scan result:

HKLM\SOFTWARE\Classes\Interface\{2BDB4DA9-94FE-4034-AAC5-CEECDCB3A33B} -> Spyware.Adlogix : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{4D8E41A8-EC1F-4C53-A10D-9120232C71BB} -> Spyware.Adlogix : Cleaned with backup
C:\WINDOWS\SYSTEM32\773a15.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\f47b89.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\925a14.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\27e293.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\42a77d.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\a5c344.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\9486d7.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\d6b036.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\f12445.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\winhlp3.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\274f43.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\84b538.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\4115f5.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\623465.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\baa5f2.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\2ad98a.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\22f0f2.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\26249c.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\7c5f0b.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\101982.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\3d6a7e.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\c8bb4b.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\4e458d.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\a7910e.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\9d08a7.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\e555a8.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\670554.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\a6d2ea.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\f7165e.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\19f6ab.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\19f010.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\c0f517.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\9f311d.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\39bfce.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\f4b562.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\c68e00.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\957ba9.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\8edfcd.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\ee6197.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\9886b9.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\a8c7ac.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\92f405.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\63f413.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\caf97f.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\68d8e9.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\5b8d9d.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\b7add1.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\edcad9.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\fc4a8f.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\ef77e7.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\b0173a.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\177d00.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\3b5364.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\080a25.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\119720.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\63e37a.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\b01812.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\698ac1.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\d8b4b7.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\256ae0.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\2d6c31.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\f76592.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\abef4d.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\cdcbe4.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\ecd9ef.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\b8dff6.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\a077ca.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\787a1b.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\b576df.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\4b90df.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\4b90df.rar/4b90df.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\4bed3b.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\2c7069.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\f873f6.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\ffbd9c.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\1a7060.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\951642.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\SYSTEM32\099d78.exe -> TrojanDownloader.Easto.b : Cleaned with backup
C:\WINDOWS\od-stnd245.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\optimize.exe -> TrojanDownloader.Dyfuca.ak : Cleaned with backup
C:\WINDOWS\mF1fnu974.dll -> TrojanDownloader.Lemmy.q : Cleaned with backup
C:\WINDOWS\p6LPKGg6C.dll -> TrojanDownloader.Rameh.b : Cleaned with backup
C:\Documents and Settings\Carol S\Cookies\carol [removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@paycounter[1].txt -> Spyware.Cookie.Paycounter : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@pro-market[1].txt -> Spyware.Cookie.Pro-market : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][2].txt -> Spyware.Cookie.Counted : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@clickagents[1].txt -> Spyware.Cookie.Clickagents : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][2].txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][2].txt -> Spyware.Cookie.Specificpop : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][2].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@track-star[1].txt -> Spyware.Cookie.Track-star : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Directnetadvertising : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@questionmarket[3].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@fastclick[3].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@gator[2].txt -> Spyware.Cookie.Gator : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed]-junction[2].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][2].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@hotlog[1].txt -> Spyware.Cookie.Hotlog : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@2o7[3].txt -> Spyware.Cookie.2o7 : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb [removed][1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Cookies/herb s@sextracker[2].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/Downloaded Program Files/MaConnect.dll -> TrojanDownloader.Esepor.t : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/od-stnd246.exe -> Dialer.Generic : Cleaned with backup
D:\CobianBU Area\Aug28-04\WINDOWS.zip/WINDOWS/od-stnd245.exe -> Dialer.Generic : Cleaned with backup


::Report End

Note: I've gone through that D:\CobianBU Area and relentlessly/mercilessly deleted with abandon so that crud doesn't get restored some day down the line. Once I'm sure I'm clean, I'm going to go and run a thorough backup of the cleaned system.

This was interesting - started looking for one thing and found a bazillion others. What do you think? Am I any closer?

H
Post #8 last edited
OK Herb, I going to look at the HJT log first to see how it looks, then I'll look over the Ewido scan results and then I will try to answer any questions you have asked.

HJT: Scan saved at 6:34:48 PM, on 09/17/2005Herb, that log looks clean :thumbup: You see anything in it that you would like to get rid of?

Ewido scan results: Created on: 5:55:20 PM, 09/17/2005This scan did a great job with that trojan, I wonder how that got on you puter in the middle of our cleanup? Any ideas? Tony Klein seems to think it is an adware downloader. That might get past Norton, we need to look at the spyware programs when you are clean.

Note: I've gone through that D:\CobianBU Area and relentlessly/mercilessly deleted with abandon so that crud doesn't get restored some day down the line. Once I'm sure I'm clean, I'm going to go and run a thorough backup of the cleaned system.

I was going to ask what that was: D:\CobianBU Area Looks like we got it, keep a close eye on things for the next day or two, here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

Keep your CCleaner, no need for it to be running, update it often. Ad-aware and Spybot are great programs but they are passive, update and run them about once a week or after a heavy surfing day. Ewido scanner is your to keep along with updates for as long as you like. No need to have it running either, just when you want a good scan.

If you have questions about programs suggested by the experts, send them along, We all have our favorite spyware programs, but I sure like SpywareBlaster, SpywareGuard and IE-Spyad. You will read about them in those links and they are all freeware. I would like to look at one final HJT log in 24 hours if you would post it. Post any questions or feedback at that time also.

Thanks…Phil
Post #9
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI