12 replies to this topic

[pskelley]

G'day Lauren, welcome to TomCoyote forum. Here is information about ctfmon.exe.
http://www.liutiliti...library/ctfmon/

Now what about the next item in the log? C:\games\happy\happy.exe Do you know what it is? Here is what I am finding.
http://www.bleepingc...y.exe-9836.html
http://castlecops.co...plist-8769.html I believe we should remove it, if you know it is not bad let me know.

I need to know what this is: C:\Documents and Settings\XP\My Documents\Buring Files\LAuREn\ICoNz\GIMP-2.0\GIMP-2.0\lib\gimp\2.0\plug-ins\script-fu.exe
It may be this: http://ptj.rozeta.co.../Soft/RawPhoto/ let me know. If you wish to check either of these, you can use these free online scans to do so. Share the information with me:
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustota...h/index_en.html

This: O17 - HKLM\System\CCS\Services\Tcpip\..\{80333631-B2F3-42FF-94CE-75D48E004EAE}: NameServer = 203.57.68.5 203.57.68.6 is this:
http://www.samspade....t?a=203.57.68.6 which is your ISP.

Now this: O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\o8lu0i39e8.dll is the major problem. This is what is causing the popups, it is a trojan, probably Look2me. It is very hard to remove, but we are lucky because Webroot will let us use a free trial verion of SpySweeper to remove this trojan. I will remove C:\games\happy\happy.exe at the same time and SS may find and remove other bad stuff that is hiding on your computer. Please follow these directions:

We must download the FREE TRIAL VERSION of SpySweeper and it should be at the very bottom of this page:
http://www.webroot.c...er/latestv.html
Use these instructions: Download the free trial version of Spy Sweeper
Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Restart your computer <<< very important.


Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\o8lu0i39e8.dll (if it is there, it may be gone)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Enable hidden files&folders..reverse the process when finished.
http://www.xtra.co.n...1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\games\ >>> folder

C:\Windows\Prefetch\ >>> delete everything in this folder (NOT THE FOLDER)
Prefetch info: http://www.windowsne...refetch-XP.html

click on Start > Run > type "cleanmgr" without the quotes then OK. Allow the program to run and remove what it finds. Post the SpySweeper log and a new HJT log along with any information I asked you for.

Thanks...pskelley
TomCoyote forum
Expert Member

When you are completely finished with the removal procedure and are satisfied that the threat has been removed follow these instructions:
http://service1.syma...src=sec_doc_nam

[pskelley]

Hi Lauren, As long as you are sure the game site is ok...you saw the information I got when I searched for happy.exe.
I see this item in the log now: C:\Program Files\iBot_V1_02\iBot_FinalV1_02.exe and Google does not ID it at all. It did not appear in the last log. Do you know where it came from. Do you have everything enabled in MSConfig?

Use the free online scanners to find out what that is, and also check this item to make sure it is safe: C:\WINDOWS\SynCor.exe
Post the results of these scans for me. The scans are as simple as navigating to the file and uploading it, you will be returned information quickly.

Please let me look at what you have installed like this:
Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list..." Button.
Save it to your desktop. Copy and paste the contents into your next reply.

We also need to place HJT in a folder so it can safely store backups for us. Return to C:\Program Files\ and RIGHT click your mouse on a blank spot, make a new folder and call it HJT. Move the HJT.exe, any logs there and the backup folder if it was created into the new folder. It will look like this now: C:\Program Files\HJT\HijackThis.exe.

Next, I see a Proxy service has been added: R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.arcom.com.au:8080;http=proxy.arcom.com.au:8080;https=proxy.arcom.com.au:8080 and the 017 item associated with the ISP is no longer there. Did you do this with the help of your Internet Service Provider. I have several surprises in the log this day and it is hard helping with the surprises.
SpySweeper has been routinely removing this items for about four months since it was updated for the Look2Me trojan. I am not sure why the removal failed but these infections are never as easy to remove as they get on the computer.

A message popped up telling me that C:/WINDOWS/System32/NvCpl.dll,NvStartup loads when windows starts up, so I removed this, and restarted, but the message popped up again...

I need the message "word for word" as it comes up. This item: C:/WINDOWS/System32/NvCpl.dll,NvStartup has to do with your nVidia based graphics cards. If I can get the error message I may be able to help? Here is information about it:
http://www.bleepingc...artup-3803.html
http://www.windowsst...art=225&end=250
This may be as simple as it needs an updated driver, I can't say until I get the error message. We may have to ask the experts in Other Computer Problems to assist with this issue?

Sweeper blocked things from this and www.a-d-w-a-r-e.com. Is this normal? The .dll file is still in the log too, and if fixed, it doesn't remove.

No, this is not normal, SpySweeper usually removes the infected item. For some reason it failed to do so. Right now you have the full protection of the program so it is blocking the site that placed the trojan on your computer. Once the trial period is over it will no longer block it.

Before we have to use more complex tools, let's give SpySweeper a try in Safe Mode, use these instructions to start in safe mode: http://www.bleepingc...tutorial61.html
Before you go to safe mode, use these instructions to enable hidden files and folders for your Operating System: http://www.xtra.co.n...1916458,00.html
Open SpySweeper and run a new scan, make sure you are follow the directions posted earlier exactly. Save the scan report.

Before you reboot, navigate to this item and delete it if it is there: C:\WINDOWS\system32\f8j20i1oe8.dll >>> file

Post the Add Remove list, a new HJT log the SS scan log and any information I requested above.

Thanks...Phil

[pskelley]

G'day, Thanks for the information you provided, this item: C:\WINDOWS\System32\SynCor.exe
appears to be gone, perhaps SpySweeper removed it, but I want to be sure.
You said this:

I don’t know what that file is, but what do you mean open the online scan??

and I want to explain. First I want you to click on this link and follow the instructions to enable the hidden files and folders for your system:
http://www.xtra.co.n...1916458,00.html
Now I want you to click any of these three links, in fact I want you to do at least two of them:
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustota...h/index_en.html
I will use the jotti site for my example. There is a little box at the top where it says "File to upload and scan". Next to the empty box is the Browse button, you can browse your whole computer from there. I want you to browse to this:
C:\WINDOWS\SynCor.exe <<< find the C:\ then the Windows folder, then find this file: SynCor.exe. Now click it to put the it in the empty box, once there click on Submit. Now you are using the online scan to find out if that is a bad file that needs to be removed. Do this with at least two of the websites. It will just take a few minutes to get results. If you have enabled hidden files and folders and you can not find the file: SynCor.exe then it may be gone. To be 100% sure,
Click on Start > Search. Use search companion to search all files and folder for this item: SynCor.exe. If it can not be located then it is gone. At least you will have learned how to use an online search to check to see if a file is bad.

Logfile of HijackThis v1.99.1 Scan saved at 2:50:34 PM, on 30/12/2005
This logfile is clean of malware

In your uninstall list I will tell you what I see. If you see anything you do not know, you should investigate. If you see anything you no longer use, you should consider uninstalling it.

Adobe Reader 6.0 >>> if you use Adobe, free version 7.0 is available
and that is really all I see, no bad programs.

It Looks like SpySweeper did the job this time, it removed a load of junk from your computer. Since the HJT log is clean, here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.o...topic.php?t=957
http://russelltexas....re/allclear.htm
http://forum.malware...wtopic.php?t=14
http://www.bleepingc...topict2520.html

I want to point out that SpySweeper is a good program and we needed it to kill that L2m trojan, but unless you purchase it, it does use a lot of resources, so you will need to keep that in mind as the trial ends.

Here are some ideas that might make your overall performance better:
http://vlaurie.com/c...s/runbetter.htm
http://www.linkgrind...rs_article.html

The error message you are receiving is a very common one, here are ideas to help you troubleshoot it:
http://www.microsoft...s/IEtopten.mspx

To make sure nothing bad is hiding in your System Restore files, use the instructions in the following link:
http://service1.syma...src=sec_doc_nam

Thanks...pskelley
TomCoyote forum
Expert Member
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

Edited by pskelley, 30 December 2005 - 10:33 PM.

[pskelley]

Hi Lauren, Let's see what we can do about these remaining issues so you can start the New Year off right. This one:

C:\WINDOWS\System32\SynCor.exe download Killbox from here: http://www.malwarere.../downloads.html
Instructions for using it are here: http://forum.malware...topic.php?t=320 You want to be sure you copy the full path of the file you wish to delete to the Killbox. C:\WINDOWS\System32\SynCor.exe
Save Killbox to your Desktop for ease of using it. Killbox will create a backup file called submit. Leave that for a day or two to make sure removing the item created no problems, then delete it. You can keep Killbox if you want, but it would be rarely used. I suggest deleting it also and downloading a new copy if you need it again.

Error loading C:\WINDOWS\System32\NvCpl.dll The specified module could not be found.
I think I said this is probably a problem because a driver is out dated earlier? I did a search at Google and returned this information: http://www.google.co.....not be found. The first link I checked was: http://www.geekstogo...?showtopic=5683 and in the link the same thing is suggested as you will read.
Don't bother with anything else because the other issues are not yours. The admin who has posted over 10,000 times suggests this:
Download and install the latest graphic driver here:
http://www.nvidia.co...ers/drivers.asp

Now if you wish to work with one of the experts here on this issue, then post here: http://forums.tomcoy...hp?showforum=83 Let the folks there know you were here and give them the information about the error message.
Here is information that might come in handy: http://www.cyberwalk...g00/310800.html

Let me wish you a Happy New Year...Phil

[pskelley]

OK Lauren, I sure hope that works for you. Looks like you never posted at "Other computer problems". I will say that all issues are not malware related, those are some good folks to know for issues other than malware. Safe Surfing...Phil

[pskelley]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php