What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

my log

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Not to sure whats going on,recently changed ISP and now cannot load zone alarm pro nor any of my other antivirus stuff. May have pressed some wrong buttons.


Logfile of HijackThis v1.99.1
Scan saved at 4:32:15 p.m., on 23/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\QTbar\QTBAR.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slingshot.co.nz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {FFD72701-2A56-629D-F717-CD3EF0FA3268} - (no file)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Apivision.com QTbar] C:\Program Files\QTbar\QTBAR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [dmwij.exe] C:\WINDOWS\system32\dmwij.exe
O4 - HKLM\..\Run: [dmoty.exe] C:\WINDOWS\system32\dmoty.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [dmhuc.exe] C:\WINDOWS\system32\dmhuc.exe
O4 - HKLM\..\Run: [gxcsv.exe] C:\WINDOWS\system32\gxcsv.exe
O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\system32\hgqhp.exe
O4 - HKLM\..\Run: [dmtgt.exe] C:\WINDOWS\system32\dmtgt.exe
O4 - HKLM\..\Run: [driver64] TForm1.exe
O4 - HKLM\..\Run: [dmhnv.exe] C:\WINDOWS\system32\dmhnv.exe
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\system32\yaemu.exe
O4 - HKLM\..\Run: [init32] ssweeper.exe
O4 - HKLM\..\Run: [dmibl.exe] C:\WINDOWS\system32\dmibl.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSTCPDLL] ssweeper.exe
O4 - HKCU\..\Run: [sound64] bnui.exe
O4 - HKCU\..\Run: [startman] vxdman.exe
O4 - HKCU\..\Run: [a-squared Antispam Guard] C:\PROGRAM FILES\A-SQUARED ANTI-SPAM\A2AntiSpamGUARD.exe
O4 - Startup: WkCalRem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/adobe/MTSI…imple-chat.html
O16 - DPF: {0D136D67-D293-4626-8C93-D12CF78E4590} (tcConference Setup) - http://67.19.231.218/v4/tc4.cab
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125306589171
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - http://download.zonelabs.com/bin/promotion…canner37360.cab
O16 - DPF: {81296632-05C2-4A99-8271-77EBCFE7844A} - http://www.talkglobally.com/confighelp/NPEVPCFG.CAB
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} - http://download.zonelabs.com/bin/promotion…ctor/WebSWK.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C7DC40E0-6601-4530-9AFB-68506CAE2628} - http://www.traderobot.com/setup-ts/setup.exe
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C74F339-6125-4167-ACA6-4E4A21D03574}: NameServer = 85.255.115.68,85.255.112.118
O17 - HKLM\System\CCS\Services\Tcpip\..\{4020A89A-78EE-4EC3-9A47-63C944DBCF62}: NameServer = 85.255.115.68,85.255.112.118
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Post #2
Welcome to the forum :wavey:

Your computer has been hijacked by people in the Ukraine. What you have is a Wareout infection.

85.255.112.0 - 85.255.127.255
Inhoster hosting company
OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine


Please download FixWareout from one of these links:
Fixwareout.exe
Fixwareout.exe

Save it to your desktop.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: (no name) - {FFD72701-2A56-629D-F717-CD3EF0FA3268} - (no file)

O1 - Hosts: localhost 127.0.0.1

O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)

O4 - HKLM\..\Run: [dmwij.exe] C:\WINDOWS\system32\dmwij.exe

O4 - HKLM\..\Run: [dmoty.exe] C:\WINDOWS\system32\dmoty.exe

O4 - HKLM\..\Run: [dmhuc.exe] C:\WINDOWS\system32\dmhuc.exe

O4 - HKLM\..\Run: [gxcsv.exe] C:\WINDOWS\system32\gxcsv.exe

O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\system32\hgqhp.exe

O4 - HKLM\..\Run: [dmtgt.exe] C:\WINDOWS\system32\dmtgt.exe

O4 - HKLM\..\Run: [driver64] TForm1.exe

O4 - HKLM\..\Run: [dmhnv.exe] C:\WINDOWS\system32\dmhnv.exe

O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\system32\yaemu.exe

O4 - HKLM\..\Run: [init32] ssweeper.exe

O4 - HKLM\..\Run: [dmibl.exe] C:\WINDOWS\system32\dmibl.exe

O4 - HKCU\..\Run: [MSTCPDLL] ssweeper.exe

O4 - HKCU\..\Run: [sound64] bnui.exe

O4 - HKCU\..\Run: [startman] vxdman.exe

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/adobe/MTSI…imple-chat.html

O17 - HKLM\System\CCS\Services\Tcpip\..\{1C74F339-6125-4167-ACA6-4E4A21D03574}: NameServer = 85.255.115.68,85.255.112.118

O17 - HKLM\System\CCS\Services\Tcpip\..\{4020A89A-78EE-4EC3-9A47-63C944DBCF62}: NameServer = 85.255.115.68,85.255.112.118

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.68 85.255.112.118


Then click "Fix checked" and close Hijack This!.

* Run fixwareout on the desktop
* Click Next, then Install, make sure "Run fixit" is checked and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.
* Once the desktop loads a text will open (report.txt). We'll need that in a bit.

"Copy/paste" a new HijackThis! log file into this thread.

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)
Post #3
Thankyou so much for your help. sorry about the slowness of this all,

Logfile of HijackThis v1.99.1
Scan saved at 8:14:35 p.m., on 23/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Program Files\Spinach AntiSpyware\AntiSpyware.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Spinach AntiSpyware.lnk = C:\Program Files\Spinach AntiSpyware\AntiSpyware.exe
O4 - Startup: WkCalRem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O16 - DPF: {0D136D67-D293-4626-8C93-D12CF78E4590} (tcConference Setup) - http://67.19.231.218/v4/tc4.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125306589171
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C7DC40E0-6601-4530-9AFB-68506CAE2628} - http://www.traderobot.com/setup-ts/setup.exe
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD4B8862-ACA4-4885-8F6A-474FE507EB06}: NameServer = 85.255.115.68 85.255.112.118
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe



Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\owt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmkar.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
* csr.exe C:\WINDOWS\System32\CSSJY.EXE
* csr.exe C:\WINDOWS\System32\CSZNT.EXE

»»»»» Misc files
* thequicklink C:\WINDOWS\System32\{77A75~1.DLL

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSSJY.EXE 51,249 2006-07-23
C:\WINDOWS\SYSTEM32\CSZNT.EXE 51,249 2006-07-22
C:\WINDOWS\SYSTEM32\DMKAR.EXE 61,968 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{77A75BF1-DB4A-41CF-8E4B-611ECC141D01}.dll
{D1D437F7-DD28-48CA-84AC-400A232CE87F}.exe
{E1DE8981-37A2-4E57-A046-F6B37E9AB187}.exe
{4F6ED6A6-D54B-4409-9FD9-BF45185D625D}.exe
{70642832-6117-4B2C-852B-D3727B58E03E}.exe
{78F55070-84E8-4D55-A3D9-38F2969E8FAF}.exe
Post #4
Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\WINDOWS\SYSTEM32\CSSJY.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSZNT.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMKAR.EXE
attrib -r -s -h C:\WINDOWS\system32\{77A75BF1-DB4A-41CF-8E4B-611ECC141D01}.dll
attrib -r -s -h C:\WINDOWS\system32\{D1D437F7-DD28-48CA-84AC-400A232CE87F}.exe
attrib -r -s -h C:\WINDOWS\system32\{E1DE8981-37A2-4E57-A046-F6B37E9AB187}.exe
attrib -r -s -h C:\WINDOWS\system32\{4F6ED6A6-D54B-4409-9FD9-BF45185D625D}.exe
attrib -r -s -h C:\WINDOWS\system32\{70642832-6117-4B2C-852B-D3727B58E03E}.exe
attrib -r -s -h C:\WINDOWS\system32\{78F55070-84E8-4D55-A3D9-38F2969E8FAF}.exe
del C:\WINDOWS\SYSTEM32\CSSJY.EXE
del C:\WINDOWS\SYSTEM32\CSZNT.EXE
del C:\WINDOWS\SYSTEM32\DMKAR.EXE
del C:\WINDOWS\system32\{77A75BF1-DB4A-41CF-8E4B-611ECC141D01}.dll
del C:\WINDOWS\system32\{D1D437F7-DD28-48CA-84AC-400A232CE87F}.exe
del C:\WINDOWS\system32\{E1DE8981-37A2-4E57-A046-F6B37E9AB187}.exe
del C:\WINDOWS\system32\{4F6ED6A6-D54B-4409-9FD9-BF45185D625D}.exe
del C:\WINDOWS\system32\{70642832-6117-4B2C-852B-D3727B58E03E}.exe
del C:\WINDOWS\system32\{78F55070-84E8-4D55-A3D9-38F2969E8FAF}.exe


Save it to your desktop as ff.bat.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O17 - HKLM\System\CCS\Services\Tcpip\..\{DD4B8862-ACA4-4885-8F6A-474FE507EB06}: NameServer = 85.255.115.68 85.255.112.118

Then click "Fix checked" and close HijackThis!

Now, the ff.bat file on the desktop. A DOS windows will open, then close

Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat

Fixwareout will begin; follow the prompts.
You will be asked to reboot your computer; please do so.

"Copy/paste" a new HijackThis! log file into this thread.

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)
Post #5
hello again,

Logfile of HijackThis v1.99.1
Scan saved at 8:20:26 a.m., on 24/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TotalAntiSpyware.lnk = C:\Program Files\Spinach AntiSpyware\AntiSpyware.exe
O4 - Startup: WkCalRem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C7DC40E0-6601-4530-9AFB-68506CAE2628} - http://www.traderobot.com/setup-ts/setup.exe
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD4B8862-ACA4-4885-8F6A-474FE507EB06}: NameServer = 85.255.115.68 85.255.112.118
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
* csr.exe C:\WINDOWS\System32\CSSJY.EXE
* csr.exe C:\WINDOWS\System32\CSZNT.EXE

»»»»» Misc files
* thequicklink C:\WINDOWS\System32\{77A75~1.DLL

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Post #6
The list is shorter. :thumbup:

Let's do it again.

Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\WINDOWS\SYSTEM32\CSSJY.EXE
attrib -r -s -h C:\WINDOWS\System32\CSZNT.EXE
attrib -r -s -h C:\WINDOWS\System32\{77A75~1.DLL
del C:\WINDOWS\SYSTEM32\CSSJY.EXE
del C:\WINDOWS\System32\CSZNT.EXE
del C:\WINDOWS\System32\{77A75~1.DLL


Save it to your desktop as ff.bat.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O17 - HKLM\System\CCS\Services\Tcpip\..\{DD4B8862-ACA4-4885-8F6A-474FE507EB06}: NameServer = 85.255.115.68 85.255.112.118

Then click "Fix checked" and close HijackThis!

Now, the ff.bat file on the desktop. A DOS windows will open, then close

Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat

Fixwareout will begin; follow the prompts.
You will be asked to reboot your computer; please do so.

"Copy/paste" a new HijackThis! log file into this thread.

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)
Post #7
thankyou,
I found no-
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD4B8862-ACA4-4885-8F6A-474FE507EB06}: NameServer = 85.255.115.68 85.255.112.118
followed all instructions tho-
Logfile of HijackThis v1.99.1
Scan saved at 12:49:57 p.m., on 24/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup

Program\AudioDeck\AudioDeck.exe
C:\Program Files\Common Files\Microsoft Shared\Works

Shared\WkCalRem.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program

Files\Alcatel\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TotalAntiSpyware.lnk = C:\Program Files\Spinach

AntiSpyware\AntiSpyware.exe
O4 - Startup: WkCalRem.LNK = C:\Program Files\Common

Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA

Technologies, Inc\VIA Audio Driver Setup

Program\AudioDeck\AudioDeck.exe
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9}

(a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C7DC40E0-6601-4530-9AFB-68506CAE2628} -

http://www.traderobot.com/setup-ts/setup.exe
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}

(Java Runtime Environment 1.4.1) -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program

Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\DMKAR.EXE 61,968 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{D1D437F7-DD28-48CA-84AC-400A232CE87F}.exe
{E1DE8981-37A2-4E57-A046-F6B37E9AB187}.exe
{4F6ED6A6-D54B-4409-9FD9-BF45185D625D}.exe
{70642832-6117-4B2C-852B-D3727B58E03E}.exe
{78F55070-84E8-4D55-A3D9-38F2969E8FAF}.exe
:thumbup:
Post #8
The "O17" didn't reappear. :thumbup:

I think we have it whipped this time.

Let's do it again.

Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\WINDOWS\SYSTEM32\DMKAR.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\{D1D437F7-DD28-48CA-84AC-400A232CE87F}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{E1DE8981-37A2-4E57-A046-F6B37E9AB187}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{4F6ED6A6-D54B-4409-9FD9-BF45185D625D}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{70642832-6117-4B2C-852B-D3727B58E03E}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{78F55070-84E8-4D55-A3D9-38F2969E8FAF}.exe
del C:\WINDOWS\SYSTEM32\DMKAR.EXE
del C:\WINDOWS\SYSTEM32\{D1D437F7-DD28-48CA-84AC-400A232CE87F}.exe
del C:\WINDOWS\SYSTEM32\{E1DE8981-37A2-4E57-A046-F6B37E9AB187}.exe
del C:\WINDOWS\SYSTEM32\{4F6ED6A6-D54B-4409-9FD9-BF45185D625D}.exe
del C:\WINDOWS\SYSTEM32\{70642832-6117-4B2C-852B-D3727B58E03E}.exe
del C:\WINDOWS\SYSTEM32\{78F55070-84E8-4D55-A3D9-38F2969E8FAF}.exe


Save it to your desktop as ff.bat.

Now, the ff.bat file on the desktop. A DOS windows will open, then close

Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat

Fixwareout will begin; follow the prompts.
You will be asked to reboot your computer; please do so.

"Copy/paste" a new HijackThis! log file into this thread.

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)

P.S. - Please turn Wordwrap OFF in Notepad before posting any more logs.
Post #9
:D :)

Logfile of HijackThis v1.99.1
Scan saved at 6:27:10 p.m., on 24/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TotalAntiSpyware.lnk = C:\Program Files\Spinach AntiSpyware\AntiSpyware.exe
O4 - Startup: WkCalRem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C7DC40E0-6601-4530-9AFB-68506CAE2628} - http://www.traderobot.com/setup-ts/setup.exe
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32

And there you have it
Post #12
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI