Hello,

I am having problems with my computer (Windows 2000 with SP4, I use it as a Web Server for a few computers) it is very slow and I seem to have a Trojan - Troj Nebuler-D runnning a winoba32.dll
which I am unable to remove even in Safe Mode.
I tried using Sophos emergency removal in Safe Mode with Command prompt and it did not work.
I am posting a copy of my HJT Log can you please have a look at it and let me know what I should do.
Your help much appreciated in advance.

Thanks,
Kenny


Logfile of HijackThis v1.99.1
Scan saved at 10:13:50 PM, on 8/29/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\CpqRcmc.exe
C:\WINNT\System32\svchost.exe
C:\MDaemon\APP\MDAEMON.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$SOPHOS\Binn\sqlservr.exe
C:\WINNT\system32\RKillSrv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Sophos Enterprise Manager\Library\bin\schdsrvc.exe
C:\WINNT\System32\snmp.exe
C:\MDaemon\APP\CFEngine.exe
C:\WINNT\System32\snmptrap.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\MDaemon\WorldClient\WorldClient.exe
C:\Program Files\Sophos\Remote Management System\AutoUpdateAgentNT.exe
C:\Program Files\Sophos\Enterprise Console\CertificationManagerServiceNT.exe
C:\Program Files\Sophos\Remote Management System\EMLibUpdateAgentNT.exe
C:\Program Files\Sophos\Enterprise Console\MgntSvc.exe
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE
C:\Program Files\SysAid\IliAS.exe
C:\DMI\Win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
D:\SUS\wusync\WUSyncSvc.exe
C:\WINNT\System32\CPQNiMgt\CPQNIMGT.EXE
C:\WINNT\system32\cpqmgmt\CqMgServ\CqMgServ.EXE
C:\WINNT\system32\cpqmgmt\cqmgstor\cqmgstor.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\domtimec.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\sysdown.exe
C:\WINNT\system32\cpqmgmt\CqMgHost\CQMGHOST.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
\m2mxp\users\Profiles\administrator\?ymantec\?poolsv.exe
C:\WINNT\system32\DOBE~1\rundll32.exe
C:\Program Files\Sophos Sweep for NT\ICMON.EXE
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\LinkMonitor\LinkMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\notepad.exe
D:\Kenny\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Minerva 2
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = m2web.minerva2.com;
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [lhqrsj] C:\WINNT\system32\lplasl.exe reg_run
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [Break_Reminder] "C:\Program Files\Break Reminder\Break Reminder.exe" 1
O4 - HKCU\..\Run: [Xft] \\m2mxp\users\Profiles\administrator\?ymantec\?poolsv.exe
O4 - HKCU\..\Run: [hewst] C:\WINNT\system32\lplasl.exe reg_run
O4 - HKCU\..\Run: [Bpoo] "C:\WINNT\system32\DOBE~1\rundll32.exe" -vt yax
O4 - Startup: Check Google.lnk = C:\Program Files\LinkMonitor\LinkMonitor.exe
O4 - Global Startup: InterCheck Monitor.LNK = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {0246ECA8-0000-0000-0000-000000000000} - http://www.kumudam.com/wfplayer/tdserver.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstall…50g3/model.html
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1129243277396
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdcco…ad/IbmEgath.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {BD05D496-E9F0-4776-9180-419E90715E57} (TM_GistFontResourcesforWeb Control) - http://eroll.tn.nic.in/IE/cab/TMData.cab
O16 - DPF: {E85FDB2D-2819-11D4-A59A-00600891E126} (IPlugin Control) - http://eroll.tn.nic.in/IE/cab/iPlugin.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Minerva2.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{962ACA96-B9D6-4A85-96AF-8CDF58135131}: NameServer = 10.108.2.7,10.108.2.10,10.108.2.251
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Minerva2.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = Minerva2.com
O23 - Service: Compaq NIC Agents (CPQNicMgmt) - Compaq Computer Corp. - C:\WINNT\System32\CPQNiMgt\CPQNIMGT.EXE
O23 - Service: Compaq Remote Monitor Service (CpqRcmc) - Compaq - C:\WINNT\System32\CpqRcmc.exe
O23 - Service: Compaq Web Agent (CpqWebMgmt) - HP Corporation - C:\WINNT\System32\CPQMGMT\CPQWMGMT.EXE
O23 - Service: Compaq Foundation Agents (CqMgHost) - Compaq Computer Corp. - C:\WINNT\system32\cpqmgmt\CqMgHost\CQMGHOST.EXE
O23 - Service: Compaq Server Agents (CqMgServ) - Compaq Computer Corp. - C:\WINNT\system32\cpqmgmt\CqMgServ\CqMgServ.EXE
O23 - Service: Compaq Storage Agents (CqMgStor) - Compaq Computer Corp. - C:\WINNT\system32\cpqmgmt\cqmgstor\cqmgstor.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Domain Time Client - Greyware Automation Products
Web: http://www.greyware.com
FTP: ftp://ftp.greyware.com
Email: [removed]
Phone: [removed] - C:\WINNT\system32\domtimec.exe
O23 - Service: MDaemon - Alt-N Technologies, Ltd. - C:\MDaemon\APP\MDAEMON.EXE
O23 - Service: Remote Process Killer - Unknown owner - C:\WINNT\system32\RKillSrv.exe
O23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\WINNT\system32\ScsiAccess.EXE (file missing)
O23 - Service: Sophos Enterprise Manager Scheduler (SEMScheduler) - Sophos Plc - C:\Program Files\Sophos Enterprise Manager\Library\bin\schdsrvc.exe
O23 - Service: Sophos Agent - Unknown owner - C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe" -service -name Agent (file missing)
O23 - Service: Sophos AutoUpdate Agent - Unknown owner - C:\Program Files\Sophos\Remote Management System\AutoUpdateAgentNT.exe" -service -name ALC (file missing)
O23 - Service: Sophos Certification Manager - Unknown owner - C:\Program Files\Sophos\Enterprise Console\CertificationManagerServiceNT.exe" -background -ORBSvcConf "C:\Program Files\Sophos\Enterprise Console\svc.conf (file missing)
O23 - Service: Sophos EMLibUpdate Agent - Unknown owner - C:\Program Files\Sophos\Remote Management System\EMLibUpdateAgentNT.exe" -service -name EMLib (file missing)
O23 - Service: Sophos Management Service - Sophos Plc. - C:\Program Files\Sophos\Enterprise Console\MgntSvc.exe
O23 - Service: Sophos Message Router - Unknown owner - C:\Program Files\Sophos\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194 (file missing)
O23 - Service: Hermes EMail Server (SvcHermes) - Unknown owner - C:\Program Files\Alixoft\Hermes\HermesSvc.exe (file missing)
O23 - Service: Sweep for Windows NT Network (SWEEPNET) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
O23 - Service: Sweep for Windows NT Update (SWEEPUPDATE) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE
O23 - Service: SysAid Agent (SysAidAgent) - Ilient Ltd. - C:\Program Files\SysAid\IliAS.exe
O23 - Service: hp ProLiant System Shutdown Service (sysdown) - Compaq Computer Corporation - C:\WINNT\System32\sysdown.exe
O23 - Service: Tccom - Unknown owner - C:\Program Files\Resource Kit\tccom.exe
O23 - Service: WinAgents TFTP Service (TFTPd) - Unknown owner - C:\PROGRA~1\WINAGE~1\TFTPSE~1\TFTPd.exe (file missing)
O23 - Service: Win32sl - Intel - C:\DMI\Win32\bin\Win32sl.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\ORL\VNC\WinVNC.exe" -service (file missing)