What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Got somebad stuff

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
About 4 days ago I started having major probs witht one of my machines. It appeared that every timeI made a change to the machines local policies to allow other users to access files on it within Minutes it is changed back to the original value. This was happening even when I disconnected the machine from the network. I used windows update and Service Packed the machine up to SP2. then I ran all Kinds of virus and spyware removal stuff on it. I discovered that it did indeed have a lot of bad stuff. I never fixed the sharing problem but I did remove a lot of bad malware/virus stuff. Then when running net-stat I discovered it was scanning it appeared. this appears to be causing a MAJOR slowdown on the machine and web pages usually are not loading well now due to Winsock probs because of the Scanning.
Anyway, I have posted my nets-lat log and HJT log below. I really hope one of you guru's can help.
Thanx.

Below is a copy of my netstat log….
as you can see it appears thet something appears to be scanning for port 5900

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\paul>netstat -no

Active Connections

  Proto  Local Address		  Foreign Address		State		   PID
  TCP	127.0.0.1:1077		 127.0.0.1:2638		 TIME_WAIT	   0
  TCP	127.0.0.1:1397		 127.0.0.1:2638		 ESTABLISHED	 1720
  TCP	127.0.0.1:2638		 127.0.0.1:1397		 ESTABLISHED	 2396
  TCP	127.0.0.1:8100		 127.0.0.1:1292		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:1675		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:1690		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:1716		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:1736		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:1820		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:1975		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:2032		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:2138		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:2245		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:2286		 TIME_WAIT	   0
  TCP	127.0.0.1:8100		 127.0.0.1:2287		 TIME_WAIT	   0
  TCP	192.168.1.114:1036	 192.168.1.104:135	  TIME_WAIT	   0
  TCP	192.168.1.114:1037	 192.168.1.104:1025	 TIME_WAIT	   0
  TCP	192.168.1.114:1038	 192.168.1.104:1025	 TIME_WAIT	   0
  TCP	192.168.1.114:1039	 192.168.1.104:445	  TIME_WAIT	   0
  TCP	192.168.1.114:1047	 [removed]:4000	   ESTABLISHED	 1876
  TCP	192.168.1.114:1050	 192.168.1.104:135	  TIME_WAIT	   0
  TCP	192.168.1.114:1051	 192.168.1.104:1025	 TIME_WAIT	   0
  TCP	192.168.1.114:1054	 192.168.1.104:1025	 TIME_WAIT	   0
  TCP	192.168.1.114:1060	 192.168.1.104:389	  TIME_WAIT	   0
  TCP	192.168.1.114:1061	 192.168.1.104:445	  TIME_WAIT	   0
  TCP	192.168.1.114:1063	 192.168.1.104:1025	 TIME_WAIT	   0
  TCP	192.168.1.114:1071	 192.168.1.104:389	  TIME_WAIT	   0
  TCP	192.168.1.114:1074	 192.168.1.104:445	  TIME_WAIT	   0
  TCP	192.168.1.114:1091	 [removed]:6667	   ESTABLISHED	 1552
  TCP	192.168.1.114:1291	 [removed]:80	 ESTABLISHED	 2680
  TCP	192.168.1.114:1308	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1309	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1310	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1311	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1312	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1313	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1314	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1315	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1316	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1317	 [removed]:5900	  SYN_SENT		1876
  TCP	192.168.1.114:1318	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1319	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1320	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1321	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1322	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1323	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1324	 [removed]:5900	  SYN_SENT		1876
  TCP	192.168.1.114:1325	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1326	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1327	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1328	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1329	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1330	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1331	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1332	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1333	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1334	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1335	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1336	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1338	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1339	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1340	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1341	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1342	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1343	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1344	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1345	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1346	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1348	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1349	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1350	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1351	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1352	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1353	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1354	 [removed]:5900   SYN_SENT		1876
  TCP	192.168.1.114:1355	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1356	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1357	 [removed]:5900	  SYN_SENT		1876
  TCP	192.168.1.114:1358	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1359	 [removed]:5900	SYN_SENT		1876
  TCP	192.168.1.114:1360	 [removed]:5900	 SYN_SENT		1876
  TCP	192.168.1.114:1506	 192.168.1.106:445	  TIME_WAIT	   0
  TCP	192.168.1.114:1830	 192.168.1.104:135	  ESTABLISHED	 960
  TCP	192.168.1.114:1953	 192.168.1.104:389	  TIME_WAIT	   0
  TCP	192.168.1.114:2115	 192.168.1.106:139	  ESTABLISHED	 4
  TCP	192.168.1.114:2345	 192.168.1.104:135	  ESTABLISHED	 1220
  TCP	192.168.1.114:2349	 192.168.1.104:1025	 ESTABLISHED	 1220
  TCP	192.168.1.114:2352	 192.168.1.104:389	  TIME_WAIT	   0
  TCP	192.168.1.114:8080	 192.168.1.101:2872	 TIME_WAIT	   0

Below is a copy of my HiJackThis log….I sure hope one of you guys can help me with this…it's got me kinda nuts….

Logfile of HijackThis v1.99.1
Scan saved at 10:28:10 AM, on 8/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\ccxgui\ccXservice.exe
C:\Program Files\ccxgui\ccxstream.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Sys32Boot.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\sstray.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\tppaldr.exe
C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\system32\HpMmKbd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Symantec\Ghost\bin\rteng7.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system\wcdvtray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Common Files\TiVo Shared\Transfer\TivoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\Handspring\Hotsync.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497 - (no file)
O1 - Hosts: 24.214.7.77 www.speedreeser.com
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [LyraHD2TrayApp] "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [o73Q32S] nvw2dvaa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [OWCWebCamDV] C:\WINDOWS\system\wcdvtray.exe
O4 - HKLM\..\Run: [MimBoot] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mimboot.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ATIRmtWndr] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TivoTransfer.exe" /auto:TivoTransfer /registry /service
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /auto:TivoServer /registry /service
O4 - Startup: palmOne Registration.lnk = C:\Program Files\Handspring\register.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Handspring\Hotsync.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.allposters.com
O15 - Trusted Zone: http://www.classmates.com
O15 - Trusted Zone: http://bricks.coupons.com
O15 - Trusted Zone: http://offers.e-centives.com
O15 - Trusted Zone: http://www.gcinproject.com
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://*.poonew
O15 - Trusted Zone: http://www.surveymonkey.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154642725764
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://demos.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PanamaPaul.com
O17 - HKLM\Software\..\Telephony: DomainName = PanamaPaul.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{405EBBBC-60FD-43B0-8789-35815D9ADFAF}: NameServer = 192.168.1.104,69.1.30.50
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PanamaPaul.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PanamaPaul.com
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ccXgui - [XC]D-Ice - C:\Program Files\ccxgui\ccXservice.exe
O23 - Service: Commander Service - Seagull Scientific, Inc - C:\Program Files\Seagull\BarTender 7.10\Trial\CmdrSrv.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Symantec Ghost Database Service (ngdbserv) - Symantec Corporation - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Symantec Ghost Configuration Server (NGServer) - Symantec Corporation - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINDOWS\lsass.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
O23 - Service: win32crc - Unknown owner - C:\WINDOWS\Sys32Boot.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #2
Welcome to the forum :wavey:

Please disable Teatimer, it can interfere with the cleaning process:

on the Teatimer icon in the system tray and "exit".

Then do this:

How to Disable Teatimer

After we have cleaned your system, please be sure to reverse this process, and re-enable Teatimer.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497 - (no file)

O2 - BHO: (no name) - SOFTWARE - (no file)

O4 - HKLM\..\Run: [o73Q32S] nvw2dvaa.exe

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

C:\WINDOWS\System32\nvw2dvaa.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread.

These I find highly suspicous:

O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINDOWS\lsass.exe

O23 - Service: win32crc - Unknown owner - C:\WINDOWS\Sys32Boot.exe

Please go to these free online file checkers:

Kaspersky Online File Scanner

Jotti Online File Scanner

VirusTotal Online File Scanner

And submit these files for a virus scan:

C:\WINDOWS\lsass.exe
(Not the one in the system32 folder - that one is legit)

C:\WINDOWS\Sys32Boot.exe

Let me know the results.

You don't have to try all three. If it come back "infected" on one scan, you can stop there.

Let me know the results.
:)
Post #3
Okay….

1st…thankyou so much for your prompt assistance Micah….

Guys like you are lifesavers….

I am a network engineer of 13 years and this one had me stumped…I was already looking at sys32boot.exe and lsass.exe pretty hard but your info confirmed my suspicions….

They were both infected with some backdoors….

I renamed them both to .OLD and rebooted to make sure thay haven't regenned….

I followed the rest of your instructions and here is my new HJT log below…

Any more advice?

Logfile of HijackThis v1.99.1
Scan saved at 12:32:27 PM, on 8/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\ccxgui\ccXservice.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\ccxgui\ccxstream.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\WINDOWS\tppaldr.exe
C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\system32\HpMmKbd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system\wcdvtray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Common Files\TiVo Shared\Transfer\TivoTransfer.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\Program Files\Handspring\Hotsync.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Symantec\Ghost\bin\rteng7.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\mmc.exe
C:\HJT\HijackThis.exe

O1 - Hosts: 24.214.7.77 www.speedreeser.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [LyraHD2TrayApp] "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [OWCWebCamDV] C:\WINDOWS\system\wcdvtray.exe
O4 - HKLM\..\Run: [MimBoot] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mimboot.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ATIRmtWndr] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TivoTransfer.exe" /auto:TivoTransfer /registry /service
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /auto:TivoServer /registry /service
O4 - Startup: palmOne Registration.lnk = C:\Program Files\Handspring\register.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Handspring\Hotsync.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.allposters.com
O15 - Trusted Zone: http://www.classmates.com
O15 - Trusted Zone: http://bricks.coupons.com
O15 - Trusted Zone: http://offers.e-centives.com
O15 - Trusted Zone: http://www.gcinproject.com
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://*.poonew
O15 - Trusted Zone: http://www.surveymonkey.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154642725764
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://demos.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PanamaPaul.com
O17 - HKLM\Software\..\Telephony: DomainName = PanamaPaul.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{405EBBBC-60FD-43B0-8789-35815D9ADFAF}: NameServer = 192.168.1.104,69.1.30.50
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PanamaPaul.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PanamaPaul.com
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ccXgui - [XC]D-Ice - C:\Program Files\ccxgui\ccXservice.exe
O23 - Service: Commander Service - Seagull Scientific, Inc - C:\Program Files\Seagull\BarTender 7.10\Trial\CmdrSrv.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Symantec Ghost Database Service (ngdbserv) - Symantec Corporation - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Symantec Ghost Configuration Server (NGServer) - Symantec Corporation - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINDOWS\lsass.exe (file missing)
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
O23 - Service: win32crc - Unknown owner - C:\WINDOWS\Sys32Boot.exe (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #4
The HOSTS and Trusted Zone entries are optional.

O1 - Hosts: 24.214.7.77 www.speedreeser.com

O15 - Trusted Zone: http://www.allposters.com

O15 - Trusted Zone: http://www.classmates.com

O15 - Trusted Zone: http://bricks.coupons.com

O15 - Trusted Zone: http://offers.e-centives.com

O15 - Trusted Zone: http://www.gcinproject.com

O15 - Trusted Zone: *.musicmatch.com

O15 - Trusted Zone: http://*.poonew

O15 - Trusted Zone: http://www.surveymonkey.com

O15 - Trusted Zone: *.musicmatch.com (HKLM)

If not recognized as "friendly" - remove them.

To "clean up" your registry, I advise this:

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINDOWS\lsass.exe (file missing)

O23 - Service: win32crc - Unknown owner - C:\WINDOWS\Sys32Boot.exe (file missing)

Then click "Fix checked" and close Hijack This!.

Now, please go to:

Start –> Run

In the box type in services.msc then hit < Enter > (or click OK)

In the Name column look for:

Microsoft sdk core

< Double-click > it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\lsass.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column look for:

win32crc

< Double-click > it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\Sys32Boot.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

Close the services.msc window.

Reboot.

That should do it.

Any more problems, just post again. :thumbup:

Thank you for choosing TomCoyote for your malware removal solutions.

M68 :)

Securing Your PC After An Attack
Post #5

Guys like you are lifesavers….

Personally… I'm tutti-fruitti!!!
:wacko:

;)

:rofl:

I've been working with PC's since 1980.

I learn something new about them almost every day…
:) :thumbup:

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI