May have contracted a trojan

aya9877 Topic Starter

Post #1October 6, 2005, 2:40 PM UTC

I received an instant message from a friend of mine with a link in it that I was later told was a virus. Just doing a check to see. Here's my hijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 10:25:29 AM, on 10/6/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Novell\XTAgent.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\OfficeScan NT\ntrtscan.exe
C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
C:\Program Files\PatchLink\Update Agent\GravitixService.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\OfficeScan NT\tmlisten.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\TEMP\TMC3D5.EXE
C:\Program Files\Novell\ZENworks\Nalwin32.exe
C:\Program Files\Novell\ZENworks\NalWin.exe
C:\Program Files\Novell\ZENworks\NalAgent.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\dpmw32.exe
C:\WINNT\system32\NWTRAY.EXE
C:\Program Files\OfficeScan NT\pccntmon.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\system32\lock1.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\PROGRA~1\Cognos\COMMON~1\bin\WINLOG~1.EXE
C:\Program Files\Novell\GroupWise\Notify.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Novell\GroupWise\GrpWise.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Novell\GroupWise\GWSync.exe
C:\Documents and Settings\rfzadm\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.shands.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.shands.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SHANDS HOSPITAL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NDPS] C:\WINNT\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PDDM] C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [strtas] lock1.exe
O4 - HKLM\..\RunServices: [strtas] lock1.exe
O4 - HKCU\..\Run: [strtas] lock1.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-sp.htm
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-sp.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://intranet.shands.org
O15 - Trusted Zone: http://magic.shands.org
O15 - Trusted Zone: http://magic.shands.org (HKLM)
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINNT\msxml4.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINNT\system32\Novell\XtNotify.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINNT\system32\cusrvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: PatchLink Install - Unknown owner - C:\WINNT\PatchLnk\DplyWzrd\PLInstSv.exe
O23 - Service: PatchLink Update - PatchLink Corporation - C:\Program Files\PatchLink\Update Agent\GravitixService.exe
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\tmlisten.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINNT\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Thanks in advance.

aya9877

Post #2October 10, 2005, 2:12 PM UTC

bump. Now I definitely think there is a problem. IE won't open and I keep receiving an error that says cannot find c:/temp/xx.html

Micah_6:8

Post #3October 10, 2005, 2:37 PM UTC

Download Killbox from here:

Killbox.zip

Unzip it, but don't run it yet.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

c:\winnt\system32\lock1.exe
c:\winnt\system32\msdirectx.sys
c:\temp\tmc3d5.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [strtas] lock1.exe

O4 - HKLM\..\RunServices: [strtas] lock1.exe

O4 - HKCU\..\Run: [strtas] lock1.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINNT\msxml4.cab

Then click "Fix checked", and close Hijack This!

Run Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new log file into this thread.

aya9877

Post #4October 11, 2005, 1:40 PM UTC

Here's my latest hijackthis file.

Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 9:36:48 AM, on 10/11/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Novell\XTAgent.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\OfficeScan NT\ntrtscan.exe
C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
C:\Program Files\PatchLink\Update Agent\GravitixService.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\OfficeScan NT\tmlisten.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\TEMP\OTB45D.EXE
C:\Program Files\Novell\ZENworks\Nalwin32.exe
C:\Program Files\Novell\ZENworks\NalWin.exe
C:\Program Files\Novell\ZENworks\NalAgent.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\dpmw32.exe
C:\WINNT\system32\NWTRAY.EXE
C:\Program Files\OfficeScan NT\pccntmon.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\program files\Trillian\Trillian.exe
C:\Documents and Settings\rfzadm\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchwebzone.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchwebzone.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwebzone.com/sp2.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.shands.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SHANDS HOSPITAL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NDPS] C:\WINNT\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PDDM] C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
O4 - HKLM\..\Run: [System service75] C:\WINNT\\\etb\\pokapoka75.exe
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-sp.htm
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-sp.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://intranet.shands.org
O15 - Trusted Zone: http://magic.shands.org
O15 - Trusted Zone: http://magic.shands.org (HKLM)
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINNT\system32\Novell\XtNotify.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINNT\system32\cusrvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: PatchLink Install - Unknown owner - C:\WINNT\PatchLnk\DplyWzrd\PLInstSv.exe
O23 - Service: PatchLink Update - PatchLink Corporation - C:\Program Files\PatchLink\Update Agent\GravitixService.exe
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\tmlisten.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINNT\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Micah_6:8

Post #5October 11, 2005, 8:56 PM UTC

Unfortuantely, you've contracted a more serious infection since your last post.

Click here to download Ewido security suite - it is a trial version of the program.

Install Ewido security suite
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch Ewido, there should be an icon on your desktop double-click it.
The program will now go to the main screen

You will need to update Ewido to the latest definition files.

On the left hand side of the main screen click update
Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.

After the definitions have been updated, close Ewido.

Do NOT run a scan yet.

Reboot in "safe" mode.

Now, run Ewido, then:

Click on scanner
Click on Complete System Scan and the scan will begin (do not open any folder's or open the windows control panel while the scan is in progress).
While the scan is in progress you will be prompted to clean files, click OK
When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report.txt file to your desktop.

Now close Ewido security suite.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [System service75] C:\WINNT\\\etb\\pokapoka75.exe

Then click "Fix checked".

Reboot and "copy/paste" a new Hijack This! log file, and the report.txt file from the Ewido scan, into this thread.

aya9877

Post #6October 12, 2005, 3:23 AM UTC

Well, hopefully a reboot will fix this, but when I booted in safe mode I was unable to log in to Windows. It kept telling me my password was incorrect, though I know it wasn't. I was able to boot in regular mode and log in with the password. Could this be because I log on to a network at work? I will try again in the morning. Wish me luck!

aya9877

Post #7October 12, 2005, 3:54 PM UTC

Alright, I was able to log in under safe mode with networking and run Ewido. Here is the report produced plus a new hijackthis log.

Thanks again!

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 11:41:47 AM, 10/12/2005
+ Report-Checksum: AC269DD1

+ Scan result:

:mozilla.23:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.24:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.28:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.29:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.30:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.31:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.32:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.33:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.34:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.35:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.78:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.79:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.80:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.81:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.82:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.83:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.87:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.88:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.89:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.90:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.95:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
:mozilla.101:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.102:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.105:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.106:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.107:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.108:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.109:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.110:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.111:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.112:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.113:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.120:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.121:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.122:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.123:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.125:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.148:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.149:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.160:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.161:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.162:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.163:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.164:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.175:C:\Documents and Settings\brayaa\Application Data\Mozilla\Firefox\Profiles\v1niv85f.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\[removed][1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
C:\Documents and Settings\brayaa\Cookies\brayaa@yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\rfzadm\Desktop\hijackthis\backups\backup-20050720-150216-550.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\Documents and Settings\yatesdm\Cookies\[removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\yatesdm\Local Settings\Temporary Internet Files\Content.IE5\MH6R4PQZ\popcaploader_v6[1].cab/PopCapLoader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\WINNT\etb\nt_hide75.dll -> TrojanDownloader.Agent.tv : Cleaned with backup
C:\xz.bat -> Trojan.KillProc.a : Cleaned with backup

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 11:50:11 AM, on 10/12/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Novell\XTAgent.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\OfficeScan NT\ntrtscan.exe
C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
C:\Program Files\PatchLink\Update Agent\GravitixService.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\OfficeScan NT\tmlisten.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\TEMP\BF291F.EXE
C:\Program Files\Novell\ZENworks\Nalwin32.exe
C:\Program Files\Novell\ZENworks\NalWin.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\Dagent.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Novell\ZENworks\NalAgent.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\dpmw32.exe
C:\WINNT\system32\NWTRAY.EXE
C:\Program Files\OfficeScan NT\pccntmon.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\OfficeScan NT\pccntupd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Novell\GroupWise\GrpWise.exe
C:\Documents and Settings\rfzadm\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchwebzone.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchwebzone.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwebzone.com/sp2.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.shands.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.shands.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SHANDS HOSPITAL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NDPS] C:\WINNT\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PDDM] C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-sp.htm
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-sp.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://intranet.shands.org
O15 - Trusted Zone: http://magic.shands.org
O15 - Trusted Zone: http://magic.shands.org (HKLM)
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINNT\system32\Novell\XtNotify.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINNT\system32\cusrvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: PatchLink Install - Unknown owner - C:\WINNT\PatchLnk\DplyWzrd\PLInstSv.exe
O23 - Service: PatchLink Update - PatchLink Corporation - C:\Program Files\PatchLink\Update Agent\GravitixService.exe
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\tmlisten.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINNT\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Micah_6:8

Post #8October 12, 2005, 10:45 PM UTC

Delete this folder:

C:\WINNT\etb <— FOLDER

Check out this file for me:

C:\TEMP\BF291F.EXE

Is the file icon a dog?

aya9877

Post #9October 13, 2005, 1:05 PM UTC

Delete this folder:

C:\WINNT\etb <— FOLDER

Check out this file for me:

C:\TEMP\BF291F.EXE

Is the file icon a dog?

Yes, it's a dog. Please don't tell me to grab the box of tissues now.

Micah_6:8

Post #10October 13, 2005, 4:20 PM UTC

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchwebzone.com/sp2.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchwebzone.com/sp2.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwebzone.com/sp2.php

Then click "Fix checked".

Reboot and "copy/paste" a new Hijack This! log file into this thread.

The "dog" file icon means that it's friendly (in this case).

aya9877

Post #11October 13, 2005, 8:01 PM UTC

Let's hope this is it…

Logfile of HijackThis v1.99.1
Scan saved at 3:57:02 PM, on 10/13/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Novell\XTAgent.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\OfficeScan NT\ntrtscan.exe
C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
C:\Program Files\PatchLink\Update Agent\GravitixService.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\OfficeScan NT\tmlisten.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\TEMP\SY95E8.EXE
C:\Program Files\Novell\ZENworks\Nalwin32.exe
C:\Program Files\Novell\ZENworks\NalWin.exe
C:\TEMP\BVAUDW32.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Novell\ZENworks\NalAgent.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\system32\dpmw32.exe
C:\WINNT\system32\NWTRAY.EXE
C:\Program Files\OfficeScan NT\pccntmon.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\OfficeScan NT\pccntupd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\rfzadm\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.shands.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.shands.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SHANDS HOSPITAL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NDPS] C:\WINNT\system32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINNT\system32\zentray.exe
O4 - HKLM\..\Run: [PDDM] C:\PROGRAM FILES\PATCHLINK\UPDATE AGENT\pddm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-sp.htm
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-sp.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://intranet.shands.org
O15 - Trusted Zone: http://magic.shands.org
O15 - Trusted Zone: http://magic.shands.org (HKLM)
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Shands.Local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = shands.ufl.edu,shands.local
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINNT\system32\Novell\XtNotify.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINNT\system32\cusrvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: PatchLink Install - Unknown owner - C:\WINNT\PatchLnk\DplyWzrd\PLInstSv.exe
O23 - Service: PatchLink Update - PatchLink Corporation - C:\Program Files\PatchLink\Update Agent\GravitixService.exe
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\tmlisten.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINNT\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Micah_6:8

Post #12October 13, 2005, 9:29 PM UTC

Hmmm…

A new "unknown" has shown up:

C:\TEMP\BVAUDW32.EXE

If you don't know what that file "does for a living", then please go to these free online file checkers:

Kaspersky Online File Scanner

Jotti Online File Scanner

VirusTotal Online File Scanner

And submit this file for a virus scan:

C:\TEMP\BVAUDW32.EXE

Let me know what they say.

aya9877

Post #13October 13, 2005, 9:37 PM UTC

I went to all 3 sites and they all say the file is clean

Micah_6:8

Post #14October 13, 2005, 9:44 PM UTC

Then unless you're still having problems not evident in the log, I guess you're "good to go".

M68

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

aya9877

Post #15October 13, 2005, 11:17 PM UTC

Thank you thank you thank you for taking the time to assist me with my problem. Everything seems to be in order. A donation is on it's way!

✨ Ask AI

Ask AI