What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

ssk webhancer strange goings on

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
thank you in advance.

I have been removing malware from PCs for 4+ yrs, now, and I finally think I might lose one.

You'll see in the log that several entries keep showing up in the startup section, referring to ssk, webhancer & other misc. entries. Further, when I got to this PC, there were miltiple copies of the following folders in several folders, root, windows, system, system32, common files & users profiles.

You'll note this oddity on my log, where somehow there are "?" replacing some characters. The folders were always empty. After I deleted them, they did not come back.

the folders were:
symantec, symbols, system32, fonts, adobe, apppatch, oracle, tasks, security, microsoft, microsoft.net.

When I say multiple copies, the Windows folder contained 3-4 of each of the above mentioned entries. They were spelled correctly, though when sorted by name, they fell out of order (???)!!! I didn't know windows let this happen?!

I've spent over a day on this machine & want to try one more time before I reformat.

Also, whatever it was killed Norton AV, I have not re-installed an AV prog yet, as I have had problems installing one on an infected amchine.

Note, again, the files referenced in the startup entries in question do not exsist (as I can see).

I have run HJT, Spybot, Adaware, spysweeper, spyware doctor, prevx1, panda active scan, ccleaner, turned off sys restore, tried varius tools in safe mode…

Thank you for your help

Logfile of HijackThis v1.99.1
Scan saved at 11:09:36 AM, on 8/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\user\Desktop\Computer Maintenence\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adb…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adb…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aimtoday.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = by Dave the Computer Man
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [{19-90-04-4F-ZN}] c:\windows\system32\pldsregs.exe GID003
O4 - HKLM\..\Run: [MSConfig] "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto
O4 - HKCU\..\Run: [Iclagt] C:\Program Files\??sks\wuauclt.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [Qskjqg] C:\Program Files\Common Files\a?sembly\tracert.exe
O4 - HKCU\..\Run: [Nzcluh] C:\Program Files\Common Files\?ystem\lsass.exe
O4 - HKCU\..\Run: [Qnqvs] C:\Documents and Settings\user\Application Data\??sks\nopdb.exe
O4 - HKCU\..\Run: [Uuuefw] C:\Program Files\??crosoft.NET\fast.exe
O4 - HKCU\..\Run: [Ctasnyr] C:\Program Files\F?nts\userinit.exe
O4 - HKCU\..\Run: [Tqj] C:\Documents and Settings\user\My Documents\s?stem\winlogon.exe
O4 - HKCU\..\Run: [Mnsjrxq] C:\Program Files\s?mbols\wuaclt.exe
O4 - HKCU\..\Run: [Feg] C:\Program Files\Common Files\s?stem\javaw.exe
O4 - HKCU\..\Run: [Ehvmwfk] C:\Documents and Settings\user\My Documents\??curity\wowexec.exe
O4 - HKCU\..\Run: [Uex] C:\Documents and Settings\user\My Documents\?dobe\explorer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe (file missing)
Post #2
I might have solved it! I ran ewido and the good news is that the rouge entries no longer appear. The bad news is it seems that explorer is messed up. The PC now starts and goes only to the walpaper. no task bar, no icons. I have to open task manager (Alt-ctl-del) and end explorer, the run explorer. any suggestions? Thanks
Post #3
Nope - I was wrong - I got explorer back with the all the malware entries. Still what's funny is that nothing "picks up" the infections. The only indication that something is there is in the start-up config area (msconfig). I'm returning the PC to the owner today.
Post #4
There is a lot of Malware on that PC. It's a shame to turn it back to its owner in that condition.
If you still require assistance on this PC, please post a fresh Hijack This log into this topic and I'll help you clean it up.

Please use the [external image: Posted Image] button to reply.
Post #5
Thanks for the reply. That was the latest log. Let's start from there, if you don't mind. I will be happy to go back to the customers' location and continue with any ideas you might have. I'm eager to clean it up for them, but I can't hang on to it for weeks at a time. Thanks
Post #6
Hi dtcmcc: As I said earlier, there is a lot of Malware on this PC, but it also has a RootKit installed on it. As you know, we can never be sure a RootKit has been totally removed and could cause a multitude of problems for the owner down the line, including keyloggers, stealing Banking and Credit Card information etc.etc. It is just too much of a risk for you, to take the chance. So, I would definately recommend a full wipe of everything and start from scratch with a clean machine. It could come back to bite you otherwise.
Post #7
I will take your advice and re-do the PC this weekend. however, I'd like to know more about the rootkit. As I said, the following kept re-appearing and were not caught by any of the scans I did. The programs they are pointing to do not appear to exsist on the PC. O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKLM\..\Run: [{19-90-04-4F-ZN}] c:\windows\system32\pldsregs.exe GID003 O4 - HKLM\..\Run: [MSConfig] "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto O4 - HKCU\..\Run: [Iclagt] C:\Program Files\??sks\wuauclt.exe O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKCU\..\Run: [Qskjqg] C:\Program Files\Common Files\a?sembly\tracert.exe O4 - HKCU\..\Run: [Nzcluh] C:\Program Files\Common Files\?ystem\lsass.exe O4 - HKCU\..\Run: [Qnqvs] C:\Documents and Settings\user\Application Data\??sks\nopdb.exe O4 - HKCU\..\Run: [Uuuefw] C:\Program Files\??crosoft.NET\fast.exe O4 - HKCU\..\Run: [Ctasnyr] C:\Program Files\F?nts\userinit.exe O4 - HKCU\..\Run: [Tqj] C:\Documents and Settings\user\My Documents\s?stem\winlogon.exe O4 - HKCU\..\Run: [Mnsjrxq] C:\Program Files\s?mbols\wuaclt.exe O4 - HKCU\..\Run: [Feg] C:\Program Files\Common Files\s?stem\javaw.exe O4 - HKCU\..\Run: [Ehvmwfk] C:\Documents and Settings\user\My Documents\??curity\wowexec.exe O4 - HKCU\..\Run: [Uex] C:\Documents and Settings\user\My Documents\?dobe\explorer.exe I am most interested in what you saw to identify the rootkit… Thank you again.
Post #8
It's better to be safe than sorry, when dealing with possible RootKits, Keyloggers and Trojans that steal passwords, banking and Credit Card info.


These entries and others are a few that are bad.
Symantec Security Response has developed a removal tool for Trackware.Webhancer. Use this removal tool,as it is the easiest way to remove this risk.http://securityresponse.symantec.com/avcenter/venc/data/trackware.webhancer.htmlWebHancer Customer Companion

O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe

Use ComboFix to remove SSK
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe

ALWAYS remove New.Net in Add/Remove Programs.
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s

O4 - HKLM\..\Run: [{19-90-04-4F-ZN}] c:\windows\system32\pldsregs.exe GID003

Items stopped with msconfig, hidden from Hijack This.
O4 - HKLM\..\Run: [MSConfig] "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto

Possible RootKit
O4 - HKCU\..\Run: [Iclagt] C:\Program Files\??sks\wuauclt.exe

O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [Qskjqg] C:\Program Files\Common Files\a?sembly\tracert.exe
O4 - HKCU\..\Run: [Uex] C:\Documents and Settings\user\My Documents\?dobe\explorer.exe

Possible Rootkit. Also possible false positive. Additional research is necessary.
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe (file missing)

Sun Java is behind on updates.
Updating Java
  • Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.
Post #9
Thank you for your time, Piatan. I will see this person over the weekend & get ahold of his PC. I was hoping to avoid the re-do, but I agree that with the liklihood of an unknown rootkit lurking about, it's the best way. I will have to convince him of that, as the work I did got the PC acting "better than new" according to him and he is very happy. By the way, I ran rootkit revealer in my earlier attempts to clean the PC & it didn't flag anything.
Post #10 last edited

I will have to convince him of that, as the work I did got the PC acting "better than new" according to him and he is very happy.

By the way, I ran rootkit revealer in my earlier attempts to clean the PC & it didn't flag anything.


Right ! We have found that often to be the case. More RootKit checking tools are becoming available, but are not all created equal. RootKits are just too dangerous to take any chances with. When he finds out that his banking info, PIN Numbers, and Credit Cards could also be compromised, he may be grateful that you took the extra step to protect him and at the same time, CYA. :D
Post #11
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI