13 replies to this topic

[tabarak]

hi, my expired norton-antivirus informed me i had a virus, so i ran the online virus detector scanner from symantec.com and turns out i have a virus of sum sort called "W32.alcra.B" heres the log, plz plz plz help!!

Logfile of HijackThis v1.99.1
Scan saved at 18:01:55, on 21/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\bcmwltry.exe
C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
C:\Program Files\Lexmark 2300 Series\ezprint.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lxcgcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rsvp.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxcgjswx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packar...se=6&key=SEARCH
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\uk.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.c...earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
O4 - HKLM\..\Run: [removecpl] RemoveCpl.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcgmon.exe] "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [UStorag] c:\program files\u-storage tools2.5\ustorage.exe sys_auto_run C:\Program Files\U-Storage Tools2.5
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\microsoft office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Edited by tabarak, 21 May 2006 - 11:24 AM.

[Micah_6:8]

Here's a fairly extensive description:

W32/Alcra-B

I'm not seeing any evidence of it in the log....

All I can suggest would be this:

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.


Get Spybot - Search & Destroy from Spybot Search and Destroy
(This is the NEW Version 1.4)
Get AdAware SE Personal from Lavasoft
(This is the NEW Build 1.6)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

Configure Adaware

Configure Spybot

Reboot after running each program.

Please try at least one of these free online virus scans of your system:

Trend-Micro Housecall
Put on 'Autoclean' and delete what it can't clean.

Panda Activescan
Accept default settings.

Etrust Security Advisor
Choose 'Cure' whatever is found, then delete if unsuccessful.

Reboot after each scan.

Let me know if any of those programs finds something it can't clean, cure, remove, disinfect, or quarantine.

You said in the post in the "Other Computer Problems" forum that your Norton Antivirus subscription had expired.

Have any plans on replacing it?

[tabarak]

uhm well i sorta deleted the file it was in which was "c:\programfiles\winupdates" so i jus deleted it. cud that be why its not on the log?

[tabarak]

and iv already ran ad-aware i had like 32 negligble objects, which iv never had b4 in my scans (i scan like once every week) cud those actually be infected?

[Micah_6:8]

Just "deleting" the file wouldn't remove it from the log.

If you were "fully" infected, you wouldn't be able to delete it because it would have been "in use".

Remove c:\programfiles\winupdates from the recycle bin, and do a full system scan with your antivirus to see if it finds anything.

[Micah_6:8]

What kind of "negligble objects" are you referring to?

[tabarak]

currently running panda activescan, yeah iv been meaning to replace norton but my dad jus dusnt see what hes paying for, therefore its a waste of money in his books lol

[tabarak]

MRU list or sumfin like that i cant rmember wut it was called lol.

[tabarak]

heres the log from the panda activescan, it sez i have 11 spyware objects and 2 disinfected virus i think.. Incident Status Location Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.zedo.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.statcounter.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.com.com/] Adware:Adware/CWS.Searchmeup Not disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[GetAccess.class] Adware:Adware/CWS.Searchmeup Not disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[Installer.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[NewURLClassLoader.class] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Tabarak\Cookies\tabarak@com[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Tabarak\Cookies\tabarak@tribalfusion[1].txt Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Tabarak\Cookies\tabarak@weborama[2].txt

[Micah_6:8]

There's a few links here for free antivirus products:

Post Infection Items To Ponder

If/when you decide to switch, do it this way:

1. Run at least one of those online scans to be sure you're not currently infected. If no infections are found, proceed. If any are found, do what it takes to remove them, and scan again.

2. Download, but don't run, the installation program for the new antivirus.

3. Completely disconnect from the internet.

4. Uninstall your current antivirus, then reboot.

5. Install the new anitvirus, then reboot.

6. Connect to the internet, and update the definitions for the new antivirus (if necessary).

An "out of date" antivirus is a liability, NOT an asset...

Don't worry about the MRU objects.

[Micah_6:8]

The cookies aren't a tragedy...

Adware:Adware/CWS.Searchmeup Not disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[GetAccess.class]
Adware:Adware/CWS.Searchmeup Not disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[NewSecurityClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Tabarak\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jrl.jar-383ccec8-1ca27c68.zip[NewURLClassLoader.class]

Let's do this:

Go to:

Start --> Control Panel

Here you'll probably have to click "Other Control Panel Options" (left side of screen)

Your Java Plug-in icon should appear on the screen. Looks like a coffee cup.

Click it.

Then click the "Cache" tab at the top,

Then click the "Clear" button (upper right), then click "Yes".

Close the Java Plug-in and the Control Panel windows.

Run a scan again.

[tabarak]

yippy! thanks alot! ill get rid of these cookies when im not using hte comp...spybot slows my comp down lol. Incident Status Location Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.zedo.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.statcounter.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Tabarak\Application Data\Mozilla\Firefox\Profiles\gqssedos.default\cookies.txt[.com.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Tabarak\Cookies\tabarak@com[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Tabarak\Cookies\tabarak@tribalfusion[1].txt Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Tabarak\Cookies\tabarak@weborama[2].txt

[Micah_6:8]

Great!!! Thank you for using the forum. M68

[Micah_6:8]

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.